NIST Special Publication 800-38A
2001 Edition

Recommendation for Block
Cipher Modes of Operation
Methods and Techniques
Morris Dworkin

C O M P U T E R

S E C U R I T Y

ii

C O M P U T E R

S E C U R I T Y

Computer Security Division
Information Technology Laboratory
National Institute of Standards and Technology
Gaithersburg, MD 20899-8930

December 2001

U.S. Department of Commerce
Donald L. Evans, Secretary
Technology Administration
Phillip J. Bond, Under Secretary of Commerce for Technology
National Institute of Standards and Technology
Arden L. Bement, Jr., Directoriii

Reports on Information Security Technology
The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology(NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s
measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof ofconcept implementations, and technical analyses to advance the development and productive use of
information technology. ITL’s responsibilities include the development of technical, physical,
administrative, and management standards and guidelines for the cost-effective security and privacy ofsensitive unclassified information in Federal computer systems. This Special Publication 800-series
reports on ITL’s research, guidance, and outreach efforts in computer security, and its collaborative
activities with industry, government, and academic organizations.

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an
experimental procedure or concept adequately. Such identification is not intended to imply recommendation or
endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities,
materials, or equipment are necessarily the best available for the purpose.

National Institute of Standards and Technology Special Publication 800-38A 2001 ED
Natl. Inst. Stand. Technol. Spec. Publ. 800-38A 2001 ED, 66 pages (December 2001)
CODEN: NSPUE2

U.S. GOVERNMENT PRINTING OFFICEWASHINGTON: 2001

For sale by the Superintendent of Documents, U.S. Government Printing OfficeInternet: bookstore.gpo.gov — Phone: (202) 512-1800 — Fax: (202) 512-2250
Mail: Stop SSOP, Washington, DC 20402-0001

iv

Abstract
This recommendation defines five confidentiality modes of operation for use with an underlying
symmetric key block cipher algorithm: Electronic Codebook (ECB), Cipher Block Chaining(CBC), Cipher Feedback (CFB), Output Feedback (OFB), and Counter (CTR). Used with anunderlying block cipher algorithm that is approved in a Federal Information Processing Standard(FIPS), these modes can provide cryptographic protection for sensitive, but unclassified,computer data.
KEY WORDS: Computer security; cryptography; data security; block cipher; encryption;Federal Information Processing Standard; mode of operation.

v

Table of Contents
1

PURPOSE .......................................................................................................................................................... 1

2

AUTHORITY .................................................................................................................................................... 1

3

INTRODUCTION ............................................................................................................................................. 1

4

DEFINITIONS, ABBREVIATIONS, AND SYMBOLS................................................................................. 3
4.1
DEFINITIONS AND ABBREVIATIONS ............................................................................................................ 3
4.2
SYMBOLS .................................................................................................................................................... 5
4.2.1
Variables ............................................................................................................................................... 5
4.2.2
Operations and Functions..................................................................................................................... 5

5

PRELIMINARIES............................................................................................................................................. 7
5.1
5.2
5.3
5.4

6

UNDERLYING BLOCK CIPHER ALGORITHM ................................................................................................. 7
REPRESENTATION OF THE PLAINTEXT AND THE CIPHERTEXT ..................................................................... 7
INITIALIZATION VECTORS........................................................................................................................... 8
EXAMPLES OF OPERATIONS AND FUNCTIONS ............................................................................................. 8

BLOCK CIPHER MODES OF OPERATION ............................................................................................... 9
6.1
6.2
6.3
6.4
6.5

THE ELECTRONIC CODEBOOK MODE.......................................................................................................... 9
THE CIPHER BLOCK CHAINING MODE ...................................................................................................... 10
THE CIPHER FEEDBACK MODE ................................................................................................................. 11
THE OUTPUT FEEDBACK MODE ................................................................................................................ 13
THE COUNTER MODE ............................................................................................................................... 15

APPENDIX A: PADDING ...................................................................................................................................... 17
APPENDIX B: GENERATION OF COUNTER BLOCKS ................................................................................. 18
B.1
B.2

THE STANDARD INCREMENTING FUNCTION ............................................................................................. 18
CHOOSING INITIAL COUNTER BLOCKS ..................................................................................................... 19

APPENDIX C: GENERATION OF INITIALIZATION VECTORS ................................................................. 20
APPENDIX D: ERROR PROPERTIES ................................................................................................................ 21
APPENDIX E: MODES OF TRIPLE DES............................................................................................................ 23
APPENDIX F: EXAMPLE VECTORS FOR MODES OF OPERATION OF THE AES ................................ 24
F.1
ECB EXAMPLE VECTORS ......................................................................................................................... 24
F.1.1 ECB-AES128.Encrypt ......................................................................................................................... 24
F.1.2 ECB-AES128.Decrypt ......................................................................................................................... 24
F.1.3 ECB-AES192.Encrypt ......................................................................................................................... 25
F.1.4 ECB-AES192.Decrypt ......................................................................................................................... 25
F.1.5 ECB-AES256.Encrypt ......................................................................................................................... 26
F.1.6 ECB-AES256.Decrypt ......................................................................................................................... 26
F.2
CBC EXAMPLE VECTORS ......................................................................................................................... 27
F.2.1 CBC-AES128.Encrypt ......................................................................................................................... 27
F.2.2 CBC-AES128.Decrypt......................................................................................................................... 27
F.2.3 CBC-AES192.Encrypt ......................................................................................................................... 28
F.2.4 CBC-AES192.Decrypt......................................................................................................................... 28vi

F.2.5 CBC-AES256.Encrypt ......................................................................................................................... 28
F.2.6 CBC-AES256.Decrypt......................................................................................................................... 29
F.3
CFB EXAMPLE VECTORS ......................................................................................................................... 29
F.3.1 CFB1-AES128.Encrypt ....................................................................................................................... 29
F.3.2 CFB1-AES128.Decrypt ....................................................................................................................... 31
F.3.3 CFB1-AES192.Encrypt ....................................................................................................................... 33
F.3.4 CFB1-AES192.Decrypt ....................................................................................................................... 34
F.3.5 CFB1-AES256.Encrypt ....................................................................................................................... 36
F.3.6 CFB1-AES256.Decrypt ....................................................................................................................... 37
F.3.7 CFB8-AES128.Encrypt ....................................................................................................................... 39
F.3.8 CFB8-AES128.Decrypt ....................................................................................................................... 41
F.3.9 CFB8-AES192.Encrypt ....................................................................................................................... 42
F.3.10
CFB8-AES192.Decrypt .................................................................................................................. 44
F.3.11
CFB8-AES256.Encrypt .................................................................................................................. 46
F.3.12
CFB8-AES256.Decrypt .................................................................................................................. 48
F.3.13
CFB128-AES128.Encrypt .............................................................................................................. 50
F.3.14
CFB128-AES128.Decrypt .............................................................................................................. 50
F.3.15
CFB128-AES192.Encrypt .............................................................................................................. 50
F.3.16
CFB128-AES192.Decrypt .............................................................................................................. 51
F.3.17
CFB128-AES256.Encrypt .............................................................................................................. 51
F.3.18
CFB128-AES256.Decrypt .............................................................................................................. 52
F.4
OFB EXAMPLE VECTORS ......................................................................................................................... 52
F.4.1 OFB-AES128.Encrypt ......................................................................................................................... 52
F.4.2 OFB-AES128.Decrypt......................................................................................................................... 53
F.4.3 OFB-AES192.Encrypt ......................................................................................................................... 53
F.4.4 OFB-AES192.Decrypt......................................................................................................................... 54
F.4.5 OFB-AES256.Encrypt ......................................................................................................................... 54
F.4.6 OFB-AES256.Decrypt......................................................................................................................... 55
F.5
CTR EXAMPLE VECTORS ......................................................................................................................... 55
F.5.1 CTR-AES128.Encrypt ......................................................................................................................... 55
F.5.2 CTR-AES128.Decrypt ......................................................................................................................... 56
F.5.3 CTR-AES192.Encrypt ......................................................................................................................... 56
F.5.4 CTR-AES192.Decrypt ......................................................................................................................... 57
F.5.5 CTR-AES256.Encrypt ......................................................................................................................... 57
F.5.6 CTR-AES256.Decrypt ......................................................................................................................... 57
APPENDIX G: REFERENCES.............................................................................................................................. 59

Table of Figures
Figure 1: The ECB Mode ................................................................................................................9
Figure 2: The CBC Mode ..............................................................................................................10
Figure 3: The CFB Mode ..............................................................................................................12
Figure 4: The OFB Mode ..............................................................................................................14
Figure 5: The CTR Mode ..............................................................................................................16vii

1 Purpose
This publication provides recommendations regarding modes of operation to be used withsymmetric key block cipher algorithms.

2 Authority
This document has been developed by the National Institute of Standards and Technology(NIST) in furtherance of its statutory responsibilities under the Computer Security Act of 1987
(Public Law 100-235) and the Information Technology Management Reform Act of 1996,
specifically 15 U.S.C. 278 g-3(a)(5). This is not a guideline within the meaning of 15 U.S.C. 278
g-3 (a)(5).
This recommendation is neither a standard nor a guideline, and as such, is neither mandatory nor
binding on Federal agencies. Federal agencies and non-government organizations may use thisrecommendation on a voluntary basis. It is not subject to copyright.
Nothing in this recommendation should be taken to contradict standards and guidelines that havebeen made mandatory and binding upon Federal agencies by the Secretary of Commerce under
his statutory authority. Nor should this recommendation be interpreted as altering or superseding
the existing authorities of the Secretary of Commerce, the Director of the Office of Management
and Budget, or any other Federal official.
Conformance testing for implementations of the modes of operation that are specified in thisrecommendation will be conducted within the framework of the Cryptographic Module
Validation Program (CMVP), a joint effort of the NIST and the Communications Security
Establishment of the Government of Canada. An implementation of a mode of operation must
adhere to the requirements in this recommendation in order to be validated under the CMVP.

3 Introduction
This recommendation specifies five confidentiality modes of operation for symmetric key blockcipher algorithms, such as the algorithm specified in FIPS Pub. 197, the Advanced Encryption
Standard (AES) [2]. The modes may be used in conjunction with any symmetric key block cipher
algorithm that is approved by a Federal Information Processing Standard (FIPS). The fivemodes—the Electronic Codebook (ECB), Cipher Block Chaining (CBC), Cipher Feedback(CFB), Output Feedback (OFB), and Counter (CTR) modes—can provide data confidentiality.
Two FIPS publications already approve confidentiality modes of operation for two particular
block cipher algorithms. FIPS Pub. 81 [4] specifies the ECB, CBC, CFB, and OFB modes of theData Encryption Standard (DES). FIPS Pub. 46-3 [3] approves the seven modes that are
specified in ANSI X9.52 [1]. Four of these modes are equivalent to the ECB, CBC, CFB, and
OFB modes with the Triple DES algorithm (TDEA) as the underlying block cipher; the other1three modes in ANSI X9.52 are variants of the CBC, CFB, and OFB modes of Triple DES thatuse interleaving or pipelining.
Thus, there are three new elements in this recommendation: 1) the extension of the four
confidentiality modes in FIPS Pub 81 for use with any FIPS-approved block cipher; 2) therevision of the requirements for these modes; and 3) the specification of an additional
confidentiality mode, the CTR mode, for use with any FIPS-approved block cipher.

2

4 Definitions, Abbreviations, and Symbols
4.1

Definitions and Abbreviations

Bit

A binary digit: 0 or 1.

Bit Error

The substitution of a ‘0’ bit for a ‘1’ bit, or vice versa.

Bit String

An ordered sequence of 0’s and 1’s.

Block Cipher

A family of functions and their inverse functions that is parameterized
by cryptographic keys; the functions map bit strings of a fixed length tobit strings of the same length.

Block Size

The number of bits in an input (or output) block of the block cipher.

CBC

Cipher Block Chaining.

CFB

Cipher Feedback.

Ciphertext

Encrypted data.

Confidentiality Mode

A mode that is used to encipher plaintext and decipher ciphertext. The
confidentiality modes in this recommendation are the ECB, CBC, CFB,
OFB, and CTR modes.

CTR

Counter.

Cryptographic Key

A parameter used in the block cipher algorithm that determines theforward cipher operation and the inverse cipher operation.

Data Block (Block)A sequence of bits whose length is the block size of the block cipher.

Data Segment(Segment)

In the CFB mode, a sequence of bits whose length is a parameter that
does not exceed the block size.

Decryption(Deciphering)

The process of a confidentiality mode that transforms encrypted data
into the original usable data.

ECB

Electronic Codebook.

Encryption(Enciphering)

The process of a confidentiality mode that transforms usable data into
an unreadable form.

3

Exclusive-OR

The bitwise addition, modulo 2, of two bit strings of equal length.

FIPS

Federal Information Processing Standard.

Forward Cipher
Function (Forward
Cipher Operation)

One of the two functions of the block cipher algorithm that is selectedby the cryptographic key.

Initialization Vector(IV)

A data block that some modes of operation require as an additional
initial input.

Input Block

A data block that is an input to either the forward cipher function or the
inverse cipher function of the block cipher algorithm.

Inverse Cipher
Function (Inverse
Cipher Operation)

The function that reverses the transformation of the forward cipher
function when the same cryptographic key is used.

Least Significant
Bit(s)The right-most bit(s) of a bit string.

Mode of Operation(Mode)An algorithm for the cryptographic transformation of data that features
a symmetric key block cipher algorithm.

Most Significant Bit(s) The left-most bit(s) of a bit string.
Nonce

A value that is used only once.

Octet

A group of eight binary digits.

OFB

Output Feedback.

Output Block

A data block that is an output of either the forward cipher function or
the inverse cipher function of the block cipher algorithm.

Plaintext

Usable data that is formatted as input to a mode.

4

4.2

Symbols

4.2.1 Variablesb

The block size, in bits.

j

The index to a sequence of data blocks or data segments ordered from left
to right.

n

The number of data blocks or data segments in the plaintext.

s

The number of bits in a data segment.

u

The number of bits in the last plaintext or ciphertext block.

Cj

The j ciphertext block.

th#

The j ciphertext segment.

Cn*

The last block of the ciphertext, which may be a partial block.

Ij

The j input block.

IV

The initialization vector.

K

The secret key.

Oj

The j output block.

Pj

The j plaintext block.

Cj

th

th

th

th

#

The j plaintext segment.

Pn*

The last block of the plaintext, which may be a partial block.

Tj

The j counter block.

Pj

th

th

4.2.2 Operations and Functions
X |Y

The concatenation of two bit strings X and Y.

X ⊕Y

The bitwise exclusive-OR of two bit strings X and Y of the same length.

CIPHK(X)The forward cipher function of the block cipher algorithm under the key K applied
to the data block X.

5

-1

CIPH K(X)The inverse cipher function of the block cipher algorithm under the key K applied
to the data block X.

LSBm(X)

The bit string consisting of the m least significant bits of the bit string X.

MSBm(X)

The bit string consisting of the m most significant bits of the bit string X.

[x]mThe binary representation of the non-negative integer x, in m bits, where x<2 .

m

6

5 Preliminaries
5.1

Underlying Block Cipher Algorithm

This recommendation assumes that a FIPS-approved symmetric key block cipher algorithm has
been chosen as the underlying algorithm, and that a secret, random key, denoted K, has been
established among all of the parties to the communication. The cryptographic key regulates thefunctioning of the block cipher algorithm and, thus, by extension, regulates the functioning of themode. The specifications of the block cipher and algorithms and the modes are public, so thesecurity of the mode depends, at a minimum, on the secrecy of the key.
A confidentiality mode of operation of the block cipher algorithm consists of two processes thatare inverses of each other: encryption and decryption. Encryption is the transformation of ausable message, called the plaintext, into an unreadable form, called the ciphertext; decryption is
the transformation that recovers the plaintext from the ciphertext.
For any given key, the underlying block cipher algorithm of the mode also consists of two
functions that are inverses of each other. These two functions are often called encryption anddecryption, but in this recommendation, those terms are reserved for the processes of theconfidentiality modes. Instead, as part of the choice of the block cipher algorithm, one of the twofunctions is designated as the forward cipher function, denoted CIPHK; the other function is then–1called the inverse cipher function, denoted CIPH K . The inputs and outputs of both functions arecalled input blocks and output blocks. The input and output blocks of the block cipher algorithm
have the same bit length, called the block size, denoted b.
5.2

Representation of the Plaintext and the Ciphertext

For all of the modes in this recommendation, the plaintext must be represented as a sequence ofbit strings; the requirements on the lengths of the bit strings vary according to the mode:
For the ECB and CBC modes, the total number of bits in the plaintext must be a multiple of theblock size, b; in other words, for some positive integer n, the total number of bits in the plaintext
must be nb. The plaintext consists of a sequence of n bit strings, each with bit length b. The bit
strings in the sequence are called data blocks, and the plaintext is denoted P1, P2,…, Pn.
For the CFB mode, the total number of bits in the plaintext must be a multiple of a parameter,
denoted s, that does not exceed the block size; in other words, for some positive integer n, thetotal number of bits in the message must be ns. The plaintext consists of a sequence of n bit
strings, each with bit length s. The bit strings in the sequence are called data segments, and the###plaintext is denoted P 1, P 2,…, P n.
For the OFB and CTR modes, the plaintext need not be a multiple of the block size. Let n and u
denote the unique pair of positive integers such that the total number of bits in the message is(n-1)b+u, where 1≤ u≤ b. The plaintext consists of a sequence of n bit strings, in which the bit
length of the last bit string is u, and the bit length of the other bit strings is b. The sequence is*denoted P1, P2,…, Pn-1, P n, and the bit strings are called data blocks, although the last bit string,7*

P n , may not be a complete block.
For each mode, the encryption process transforms every plaintext data block or segment into a
corresponding ciphertext data block or segment with the same bit length, so that the ciphertext isa sequence of data blocks or segments. The ciphertext is denoted as follows: for the ECB and###CBC modes, C1, C2,…, Cn; for the CFB mode, C 1, C 2,…, C n; and, for the OFB and CTR modes,**
C1, C2,…, Cn-1, C n, where C n may be a partial block.
The formatting of the plaintext, including in some cases the appending of padding bits to form
complete data blocks or data segments, is outside the scope of this recommendation. Padding is
discussed in Appendix A.
5.3

Initialization Vectors

The input to the encryption processes of the CBC, CFB, and OFB modes includes, in addition to
the plaintext, a data block called the initialization vector (IV), denoted IV. The IV is used in an
initial step in the encryption of a message and in the corresponding decryption of the message.
The IV need not be secret; however, for the CBC and CFB modes, the IV for any particular
execution of the encryption process must be unpredictable, and, for the OFB mode, unique IVs
must be used for each execution of the encryption process. The generation of IVs is discussed inAppendix C.
5.4

Examples of Operations and Functions

The concatenation operation on bit strings is denoted | ; for example, 001 | 10111 = 00110111.
Given bit strings of equal length, the exclusive-OR operation, denoted ⊕, specifies the addition,
modulo 2, of the bits in each bit position, i.e., without carries. Thus, 10011 ⊕ 10101= 00110, forexample.
The functions LSBs and MSBs return the s least significant bits and the s most significant bits of
their arguments. For example, LSB3(111011010) = 010, and MSB4(111011010) = 1110.
m

Given a positive integer m and a non-negative (decimal) integer x that is less than 2 , the binary
representation of x in m bits is denoted [x]m. For example, [45]8 = 00101101.

8

6 Block Cipher Modes of Operation
The mathematical specifications of the five modes are given in Sections 6.1-6.5, along withdescriptions, illustrations, and comments on the potential for parallel processing.
6.1

The Electronic Codebook Mode

The Electronic Codebook (ECB) mode is a confidentiality mode that features, for a given key,
the assignment of a fixed ciphertext block to each plaintext block, analogous to the assignment ofcode words in a codebook. The Electronic Codebook (ECB) mode is defined as follows:
ECB Encryption:

Cj = CIPHK(Pj)

ECB Decryption:

Pj = CIPH K(Cj)for j = 1 … n.

-1

for j = 1 … n.

In ECB encryption, the forward cipher function is applied directly and independently to eachblock of the plaintext. The resulting sequence of output blocks is the ciphertext.
In ECB decryption, the inverse cipher function is applied directly and independently to eachblock of the ciphertext. The resulting sequence of output blocks is the plaintext.
ECB Encryption

ECB Decryption

PLAINTEXTCIPHERTEXTINPUT BLOCKINPUT BLOCK

CIPHK

CIPH-1K

OUTPUT BLOCKOUTPUT BLOCKCIPHERTEXT

PLAINTEXT

Figure 1: The ECB Mode

In ECB encryption and ECB decryption, multiple forward cipher functions and inverse cipher
functions can be computed in parallel.
In the ECB mode, under a given key, any given plaintext block always gets encrypted to the9same ciphertext block. If this property is undesirable in a particular application, the ECB mode
should not be used.
The ECB mode is illustrated in Figure 1.
6.2

The Cipher Block Chaining Mode

The Cipher Block Chaining (CBC) mode is a confidentiality mode whose encryption processfeatures the combining (“chaining”) of the plaintext blocks with the previous ciphertext blocks.
The CBC mode requires an IV to combine with the first plaintext block. The IV need not besecret, but it must be unpredictable; the generation of such IVs is discussed in Appendix C.
Also, the integrity of the IV should be protected, as discussed in Appendix D. The CBC mode isdefined as follows:

ENCRYPTDECRYPTINITIALIZATIONVECTOR-1P1 = CIPH K(C1) ⊕ IV;-1
Pj = CIPH K(Cj) ⊕ Cj-1

for j = 2 … n.

PLAINTEXT 1

PLAINTEXT 2

PLAINTEXT n

⊕

⊕

⊕

INPUT BLOCK 1

INPUT BLOCK 2

INPUT BLOCK n

CIPHK

CIPHK

CIPHK

OUTPUT BLOCK 1OUTPUT BLOCK 2OUTPUT BLOCK nCIPHERTEXT 1

CIPHERTEXT 2

CIPHERTEXT n

CIPHERTEXT 1

CIPHERTEXT 2

CIPHERTEXT n

INPUT BLOCK 1

INPUT BLOCK 2

INPUT BLOCK n

CIPH-1K

CIPH-1

CIPH-1K

OUTPUT BLOCK 1OUTPUT BLOCK 2KOUTPUT BLOCK n⊕INITIALIZATIONVECTORfor j = 2 … n.

⊕

CBC Decryption:

C1 = CIPHK(P1 ⊕ IV);
Cj = CIPHK(Pj ⊕ Cj-1)⊕

CBC Encryption:

PLAINTEXT 1

PLAINTEXT 2

PLAINTEXT n

Figure 2: The CBC Mode

In CBC encryption, the first input block is formed by exclusive-ORing the first block of theplaintext with the IV. The forward cipher function is applied to the first input block, and the10resulting output block is the first block of the ciphertext. This output block is also exclusiveORed with the second plaintext data block to produce the second input block, and the forward
cipher function is applied to produce the second output block. This output block, which is thesecond ciphertext block, is exclusive-ORed with the next plaintext block to form the next input
block. Each successive plaintext block is exclusive-ORed with the previous output/ciphertext
block to produce the new input block. The forward cipher function is applied to each input blockto produce the ciphertext block.
In CBC decryption, the inverse cipher function is applied to the first ciphertext block, and theresulting output block is exclusive-ORed with the initialization vector to recover the firstplaintext block. The inverse cipher function is also applied to the second ciphertext block, andthe resulting output block is exclusive-ORed with the first ciphertext block to recover the second
plaintext block. In general, to recover any plaintext block (except the first), the inverse cipher
function is applied to the corresponding ciphertext block, and the resulting block is exclusiveORed with the previous ciphertext block.
In CBC encryption, the input block to each forward cipher operation (except the first) depends on
the result of the previous forward cipher operation, so the forward cipher operations cannot be
performed in parallel. In CBC decryption, however, the input blocks for the inverse cipher
function, i.e., the ciphertext blocks, are immediately available, so that multiple inverse cipher
operations can be performed in parallel.
The CBC mode is illustrated in Figure 2.
6.3

The Cipher Feedback Mode

The Cipher Feedback (CFB) mode is a confidentiality mode that features the feedback ofsuccessive ciphertext segments into the input blocks of the forward cipher to generate output
blocks that are exclusive-ORed with the plaintext to produce the ciphertext, and vice versa. The
CFB mode requires an IV as the initial input block. The IV need not be secret, but it must be
unpredictable; the generation of such IVs is discussed in Appendix C.
The CFB mode also requires an integer parameter, denoted s, such that 1 ≤ s ≤ b. In the##specification of the CFB mode below, each plaintext segment (P j) and ciphertext segment (C j)consists of s bits. The value of s is sometimes incorporated into the name of the mode, e.g., the1-bit CFB mode, the 8-bit CFB mode, the 64-bit CFB mode, or the 128-bit CFB mode.
The CFB mode is defined as follows:
CFB Encryption:

CFB Decryption:

I1 = IV;#
Ij = LSBb-s(Ij –1) | C j -1
Oj = CIPHK(Ij)##C j = P j ⊕ MSBs(Oj)for j = 2 … n;for j = 1, 2 … n;for j = 1, 2 … n.

I1 = IV;#
Ij = LSBb-s(Ij -1 )| C j -1

for j = 2 … n;11

Oj = CIPHK(Ij)##P j = C j ⊕ MSBs(Oj)for j = 1, 2 … n;for j = 1, 2 … n.

In CFB encryption, the first input block is the IV, and the forward cipher operation is applied to
the IV to produce the first output block. The first ciphertext segment is produced by exclusiveORing the first plaintext segment with the s most significant bits of the first output block. (Theremaining b-s bits of the first output block are discarded.) The b-s least significant bits of the IV
are then concatenated with the s bits of the first ciphertext segment to form the second input
block. An alternative description of the formation of the second input block is that the bits ofthe first input block circularly shift s positions to the left, and then the ciphertext segment
replaces the s least significant bits of the result.
The process is repeated with the successive input blocks until a ciphertext segment is produced
from every plaintext segment. In general, each successive input block is enciphered to produce
an output block. The s most significant bits of each output block are exclusive-ORed with thecorresponding plaintext segment to form a ciphertext segment. Each ciphertext segment (except
the last one) is “fed back” into the previous input block, as described above, to form a new input
block. The feedback can be described in terms of the individual bits in the strings as follows: ifth
i1i2…ib is the jth input block, and c1c2…cs is the jth ciphertext segment, then the (j+1) input blockis is+1is+2…ib c1c2…cs.

INITIALIZATIONVECTORINPUT BLOCK 2(b-s) Bits s Bits

ENCRYPTINPUT BLOCK 1

PLAINTEXT 1
s BitsINPUT BLOCK n(b-s) Bits s Bits

CIPHK

CIPHK

CIPHK

OUTPUT BLOCK 1
Select Discards Bits(b-s) Bits

OUTPUT BLOCK 2
Select Discards Bits(b-s) Bits

OUTPUT BLOCK n
Select Discards Bits(b-s) Bits⊕

PLAINTEXT 2
s Bits⊕PLAINTEXT n
s BitsCIPHERTEXT 2
s BitsCIPHERTEXT 1
s Bits⊕CIPHERTEXT n
s BitsINITIALIZATIONVECTORINPUT BLOCK 2(b-s) Bits s Bits

DECRYPTINPUT BLOCK 1

CIPHERTEXT 1
s BitsINPUT BLOCK n(b-s) Bits s Bits

CIPHK

CIPHK

CIPHK

OUTPUT BLOCK 1
Select Discards Bits(b-s) Bits

OUTPUT BLOCK 2
Select Discards Bits(b-s) Bits

OUTPUT BLOCK n
Select Discards Bits(b-s) Bits⊕

CIPHERTEXT 2
s Bits⊕PLAINTEXT 2
s BitsPLAINTEXT 1
s BitsCIPHERTEXT n
s Bits⊕PLAINTEXT n
s BitsFigure 3: The CFB ModeIn CFB decryption, the IV is the first input block, and each successive input block is formed as in
CFB encryption, by concatenating the b-s least significant bits of the previous input block with12

the s most significant bits of the previous ciphertext. The forward cipher function is applied toeach input block to produce the output blocks. The s most significant bits of the output blocks
are exclusive-ORed with the corresponding ciphertext segments to recover the plaintext
segments.
In CFB encryption, like CBC encryption, the input block to each forward cipher function (except
the first) depends on the result of the previous forward cipher function; therefore, multiple
forward cipher operations cannot be performed in parallel. In CFB decryption, the required
forward cipher operations can be performed in parallel if the input blocks are first constructed (inseries) from the IV and the ciphertext.
The CFB mode is illustrated in Figure 3.
6.4

The Output Feedback Mode

The Output Feedback (OFB) mode is a confidentiality mode that features the iteration of theforward cipher on an IV to generate a sequence of output blocks that are exclusive-ORed withthe plaintext to produce the ciphertext, and vice versa. The OFB mode requires that the IV is anonce, i.e., the IV must be unique for each execution of the mode under the given key; thegeneration of such IVs is discussed in Appendix C. The OFB mode is defined as follows:
OFB Encryption:

OFB Decryption:

I1 = IV;
Ij = Oj -1
Oj = CIPHK(Ij)
Cj = Pj ⊕ Oj**
C n= P n ⊕ MSBu(On).

for j = 2 … n;for j = 1, 2 … n;for j = 1, 2 … n-1;

I1 = IV;
Ij = Oj -1
Oj = CIPHK(Ij)
Pj = Cj ⊕ Oj**
P n = C n ⊕ MSBu(On).

for j = 2 … n;for j = 1, 2 … n;for j = 1, 2 … n-1;

In OFB encryption, the IV is transformed by the forward cipher function to produce the first
output block. The first output block is exclusive-ORed with the first plaintext block to produce
the first ciphertext block. The forward cipher function is then invoked on the first output blockto produce the second output block. The second output block is exclusive-ORed with the second
plaintext block to produce the second ciphertext block, and the forward cipher function is
invoked on the second output block to produce the third output block. Thus, the successive
output blocks are produced from applying the forward cipher function to the previous output
blocks, and the output blocks are exclusive-ORed with the corresponding plaintext blocks to
produce the ciphertext blocks. For the last block, which may be a partial block of u bits, themost significant u bits of the last output block are used for the exclusive-OR operation; theremaining b-u bits of the last output block are discarded.
In OFB decryption, the IV is transformed by the forward cipher function to produce the first13

output block. The first output block is exclusive-ORed with the first ciphertext block to recover
the first plaintext block. The first output block is then transformed by the forward cipher
function to produce the second output block. The second output block is exclusive-ORed withthe second ciphertext block to produce the second plaintext block, and the second output block isalso transformed by the forward cipher function to produce the third output block. Thus, thesuccessive output blocks are produced from applying the forward cipher function to the previous
output blocks, and the output blocks are exclusive-ORed with the corresponding ciphertext
blocks to recover the plaintext blocks. For the last block, which may be a partial block of u bits,
the most significant u bits of the last output block are used for the exclusive-OR operation; theremaining b-u bits of the last output block are discarded.

INITIALIZATIONVECTORENCRYPTINPUT BLOCK 1

INPUT BLOCK nINPUT BLOCK 2

CIPHK

CIPHK

CIPHK

OUTPUT BLOCK 1OUTPUT BLOCK 2OUTPUT BLOCK n

PLAINTEXT 1⊕

PLAINTEXT 2⊕

PLAINTEXT n

CIPHERTEXT 2

CIPHERTEXT 1⊕

CIPHERTEXT n

INITIALIZATIONVECTORINPUT BLOCK 2DECRYPTINPUT BLOCK 1

CIPHERTEXT 1

INPUT BLOCK n

CIPHK

CIPHK

CIPHK

OUTPUT BLOCK 1OUTPUT BLOCK 2OUTPUT BLOCK n⊕CIPHERTEXT 2⊕
PLAINTEXT 2

PLAINTEXT 1

CIPHERTEXT n⊕
PLAINTEXT n

Figure 4: The OFB ModeIn both OFB encryption and OFB decryption, each forward cipher function (except the first)
depends on the results of the previous forward cipher function; therefore, multiple forward cipher
functions cannot be performed in parallel. However, if the IV is known, the output blocks can begenerated prior to the availability of the plaintext or ciphertext data.
The OFB mode requires a unique IV for every message that is ever encrypted under the given
key. If, contrary to this requirement, the same IV is used for the encryption of more than one
message, then the confidentiality of those messages may be compromised. In particular, if aplaintext block of any of these messages is known, say, the jth plaintext block, then the jth outputof the forward cipher function can be determined easily from the jth ciphertext block of themessage. This information allows the jth plaintext block of any other message that is encrypted14using the same IV to be easily recovered from the jth ciphertext block of that message.
Confidentiality may similarly be compromised if any of the input blocks to the forward cipher
function for the encryption of a message is designated as the IV for the encryption of anothermessage under the given key.
The OFB mode is illustrated in Figure 4.
6.5

The Counter Mode

The Counter (CTR) mode is a confidentiality mode that features the application of the forward
cipher to a set of input blocks, called counters, to produce a sequence of output blocks that are
exclusive-ORed with the plaintext to produce the ciphertext, and vice versa. The sequence ofcounters must have the property that each block in the sequence is different from every otherblock. This condition is not restricted to a single message: across all of the messages that are
encrypted under the given key, all of the counters must be distinct. In this recommendation, thecounters for a given message are denoted T1, T2, … , Tn. Methods for generating counters are
discussed in Appendix B. Given a sequence of counters, T1 , T2 , … , Tn, the CTR mode isdefined as follows:
CTR Encryption:

Oj = CIPHK(Tj)
Cj = Pj ⊕ Oj**
C n = P n ⊕ MSBu(On).

for j = 1, 2 … n;for j = 1, 2 … n-1;

CTR Decryption:

Oj = CIPHK(Tj)
Pj = Cj ⊕ Oj**
P n = C n ⊕ MSBu(On).

for j = 1, 2 … n;for j = 1, 2 … n-1;

In CTR encryption, the forward cipher function is invoked on each counter block, and theresulting output blocks are exclusive-ORed with the corresponding plaintext blocks to produce
the ciphertext blocks. For the last block, which may be a partial block of u bits, the mostsignificant u bits of the last output block are used for the exclusive-OR operation; the remaining
b-u bits of the last output block are discarded.
In CTR decryption, the forward cipher function is invoked on each counter block, and theresulting output blocks are exclusive-ORed with the corresponding ciphertext blocks to recover
the plaintext blocks. For the last block, which may be a partial block of u bits, the mostsignificant u bits of the last output block are used for the exclusive-OR operation; the remaining
b-u bits of the last output block are discarded.
In both CTR encryption and CTR decryption, the forward cipher functions can be performed inparallel; similarly, the plaintext block that corresponds to any particular ciphertext block can berecovered independently from the other plaintext blocks if the corresponding counter block can
be determined. Moreover, the forward cipher functions can be applied to the counters prior to theavailability of the plaintext or ciphertext data.

15

ENCRYPTPLAINTEXT 1

COUNTER 1

COUNTER 2

INPUT BLOCK 1

INPUT BLOCK 2

INPUT BLOCK n. . . . .

CIPHK

CIPHK

OUTPUT BLOCK 1OUTPUT BLOCK 2⊕PLAINTEXT 2

CIPHERTEXT 1

DECRYPT

COUNTER n

CIPHKOUTPUT BLOCK n⊕⊕

PLAINTEXT n

CIPHERTEXT n

CIPHERTEXT 2

COUNTER 1

COUNTER 2

COUNTER n

INPUT BLOCK 1

INPUT BLOCK 2

INPUT BLOCK n

CIPHK

CIPHK

OUTPUT BLOCK 1OUTPUT BLOCK 2CIPHERTEXT 1⊕

CIPHERTEXT 2

PLAINTEXT 1⊕
PLAINTEXT 2

Figure 5: The CTR Mode

The CTR mode is illustrated in Figure 5.

16. . . . .

CIPHKOUTPUT BLOCK nCIPHERTEXT n⊕
PLAINTEXT nAppendix A: Padding
For the ECB, CBC, and CFB modes, the plaintext must be a sequence of one or more complete
data blocks (or, for CFB mode, data segments). In other words, for these three modes, the total
number of bits in the plaintext must be a positive multiple of the block (or segment) size.
If the data string to be encrypted does not initially satisfy this property, then the formatting of theplaintext must entail an increase in the number of bits. A common way to achieve the necessary
increase is to append some extra bits, called padding, to the trailing end of the data string as thelast step in the formatting of the plaintext. An example of a padding method is to append asingle ‘1’ bit to the data string and then to pad the resulting string by as few ‘0’ bits, possibly
none, as are necessary to complete the final block (segment). Other methods may be used; ingeneral, the formatting of the plaintext is outside the scope of this recommendation.
For the above padding method, the padding bits can be removed unambiguously, provided thereceiver can determine that the message is indeed padded. One way to ensure that the receiver
does not mistakenly remove bits from an unpadded message is to require the sender to pad every
message, including messages in which the final block (segment) is already complete. For suchmessages, an entire block (segment) of padding is appended. Alternatively, such messages canbe sent without padding if, for every message, the existence of padding can be reliably inferred,e.g., from a message length indicator.

17

Appendix B: Generation of Counter Blocks
The specification of the CTR mode requires a unique counter block for each plaintext block thatis ever encrypted under a given key, across all messages. If, contrary to this requirement, acounter block is used repeatedly, then the confidentiality of all of the plaintext blocks
corresponding to that counter block may be compromised. In particular, if any plaintext blockthat is encrypted using a given counter block is known, then the output of the forward cipher
function can be determined easily from the associated ciphertext block. This output allows anyother plaintext blocks that are encrypted using the same counter block to be easily recoveredfrom their associated ciphertext blocks.
There are two aspects to satisfying the uniqueness requirement. First, an incrementing function
for generating the counter blocks from any initial counter block can ensure that counter blocks do
not repeat within a given message. Second, the initial counter blocks, T1, must be chosen to
ensure that counters are unique across all messages that are encrypted under the given key.
B.1

The Standard Incrementing Function

In general, given the initial counter block for a message, the successive counter blocks arederived by applying an incrementing function. As in the above specifications of the modes, n is
the number of blocks in the given plaintext message, and b is the number of bits in the block.
The standard incrementing function can apply either to an entire block or to a part of a block.
Let m be the number of bits in the specific part of the block to be incremented; thus, m is apositive integer such that m ≤ b. Any string of m bits can be regarded as the binary representationmof a non-negative integer x that is strictly less than 2 . The standard incrementing function takesm[x]m and returns [x+1 mod 2 ]m.
For example, let the standard incrementing function apply to the five least significant bits ofeight bit blocks, so that b=8 and m=5 (unrealistically small values); let * represent each unknown
bit in this example, and let ***11110 represent a block to be incremented. The following
sequence of blocks results from four applications of the standard incrementing function:***11110***11111***00000***00001* * * 0 0 0 1 0.
Counter blocks in which a given set of m bits are incremented by the standard incrementingmfunction satisfy the uniqueness requirement within the given message provided that n ≤ 2 .
Whether the uniqueness requirement for counter blocks is satisfied across all messages that are
encrypted under a given key then depends on the choices of the initial counter blocks for themessages, as discussed in the next section.

18

This recommendation permits the use of any other incrementing function that generates n uniquestrings of m bits in succession from the allowable initial strings. For example, if the initial stringof m bits is not the “zero” string, i.e., if it contains at least one ‘1’ bit, then an incrementing
function can be constructed from a linear feedback shift register that is specialized to ensure asufficiently large period; see Ref. [5] for information about linear feedback shift registers.
B.2

Choosing Initial Counter Blocks

The initial counter blocks, T1, for each message that is encrypted under the given key must be
chosen in a manner than ensures the uniqueness of all the counter blocks across all the messages.
Two examples of approaches to choosing the initial counter blocks are given in this section.
In the first approach, for a given key, all plaintext messages are encrypted sequentially. Within
the messages, the same fixed set of m bits of the counter block is incremented by the standard
incrementing function. The initial counter block for the initial plaintext message may be any
string of b bits. The initial counter block for any subsequent message can be obtained byapplying the standard incrementing function to the fixed set of m bits of the final counter blockof the previous message. In effect, all of the plaintext messages that are ever encrypted under the
given key are concatenated into a single message; consequently, the total number of plaintext
mblocks must not exceed 2 . Procedures should be established to ensure the maintenance of thestate of the final counter block of the latest encrypted message, and to ensure the proper
sequencing of the messages.
A second approach to satisfying the uniqueness property across messages is to assign to eachmessage a unique string of b/2 bits (rounding up, if b is odd), in other words, a message nonce,
and to incorporate the message nonce into every counter block for the message. The leading b/2
bits (rounding up, if b is odd) of each counter block would be the message nonce, and thestandard incrementing function would be applied to the remaining m bits to provide an index tothe counter blocks for the message. Thus, if N is the message nonce for a given message, thenthe jth counter block is given by Tj = N | [j]m, for j = 1…n. The number of blocks, n, in anymmessage must satisfy n < 2 . A procedure should be established to ensure the uniqueness of themessage nonces.
This recommendation allows other methods and approaches for achieving the uniquenessproperty. Validation that an implementation of the CTR mode conforms to this recommendation
will typically include an examination of the procedures for assuring the uniqueness of counter
blocks within messages and across all messages that are encrypted under a given key.

19

Appendix C: Generation of Initialization Vectors
The CBC, CFB, and OFB modes require an initialization vector as input, in addition to theplaintext. An IV must be generated for each execution of the encryption operation, and the same
IV is necessary for the corresponding execution of the decryption operation. Therefore, the IV, orinformation that is sufficient to calculate the IV, must be available to each party to thecommunication.
The IV need not be secret, so the IV, or information sufficient to determine the IV, may betransmitted with the ciphertext.
For the CBC and CFB modes, the IVs must be unpredictable. In particular, for any given
plaintext, it must not be possible to predict the IV that will be associated to the plaintext inadvance of the generation of the IV.
There are two recommended methods for generating unpredictable IVs. The first method is to
apply the forward cipher function, under the same key that is used for the encryption of theplaintext, to a nonce. The nonce must be a data block that is unique to each execution of theencryption operation. For example, the nonce may be a counter, as described in Appendix B, ora message number. The second method is to generate a random data block using a FIPSapproved random number generator.
For the OFB mode, the IV need not be unpredictable, but it must be a nonce that is unique toeach execution of the encryption operation. For example, the nonce may be a counter, as
described in Appendix B, or a message number.
If, contrary to this requirement, the same IV is used for the OFB encryption of more than one
message, then the confidentiality of those messages may be compromised. In particular, if aplaintext block of any of these messages is known, say, the jth plaintext block, then the jth outputof the forward cipher function can be determined easily from the jth ciphertext block of themessage. This information allows the jth plaintext block of any other message that is encryptedusing the same IV to be easily recovered from the jth ciphertext block of that message.
Confidentiality may similarly be compromised if any of the input blocks to the forward cipher
function for the OFB encryption of a message is designated as the IV for the encryption ofanother message under the given key. One consequence of this observation is that IVs for the
OFB mode should not be generated by invoking the block cipher on another IV.
Validation that an implementation of the CBC, CFB, or OFB mode conforms to thisrecommendation will typically include an examination of the procedures for assuring theunpredictability or uniqueness of the IV.

20

Appendix D: Error Properties
A bit error is the substitution of a ‘0’ bit for a ‘1’ bit, or vice versa. This appendix contains a
discussion of the effects of bit errors in ciphertext blocks (or segments), counter blocks, and IVs
on the modes in this recommendation. Insertion or deletion of bits into ciphertext blocks (orsegments) is also discussed.
For any confidentiality mode, if there are any bit errors in a single ciphertext block (or segment),
then the decryption of that ciphertext block (or segment) will be incorrect, i.e., it will differ fromthe original plaintext block (or segment). In the CFB, OFB, and CTR modes, the bit error(s) inthe decrypted ciphertext block (or segment) occur in the same bit position(s) as in the ciphertext
block (or segment); the other bit positions are not affected. In the ECB and CBC modes, a bit
error may occur, independently, in any bit position of the decrypted ciphertext block, with an
expected error rate of fifty percent, depending on the strength of the underlying block cipher.
For the ECB, OFB, and CTR modes, bit errors within a ciphertext block do not affect thedecryption of any other blocks. In the CBC mode, any bit positions that contain bit errors in a
ciphertext block will also contain bit errors in the decryption of the succeeding ciphertext block;the other bit positions are not affected. In the CFB mode, bit errors in a ciphertext segment affectthe decryption of the next b/s (rounded up to the nearest integer) ciphertext segments. A bit error
may occur, independently, in any bit position in these decrypted segments, with an expected
error rate of fifty percent.
Similarly, for the CTR mode, if there is a bit error in a counter block, then a bit error may occur,
independently, in any bit position of the decryption of the corresponding ciphertext, with an
expected error rate of fifty percent.
Bit errors in IVs also affect the decryption process. In the OFB mode, bit errors in the IV affectthe decryption of every ciphertext block. In the CFB mode, bit errors in the IV affect, at aminimum, the decryption of the first ciphertext segment, and possibly successive ciphertext
segments, depending on the bit position of the rightmost bit error in the IV. (In general, a bit
error in the ith most significant bit position affects the decryptions of the first i/s (rounding up)
ciphertext segments.) For both the OFB and CFB modes, a bit error may occur, independently,
in any bit position of the affected ciphertext blocks (or segments), with an expected error rate offifty percent. In the CBC mode, if bit errors occur in the IV, then the first ciphertext block will
be decrypted incorrectly, and bit errors will occur in exactly the same bit positions as in the IV;
the decryptions of the other ciphertext blocks are not affected.
Consequently, for the CBC mode, the decryption of the first ciphertext block is vulnerable to the(deliberate) introduction of bit errors in specific bit positions of the IV if the integrity of the IV is
not protected. Similarly, for the OFB and CTR modes, the decryption of any ciphertext block isvulnerable to the introduction of specific bit errors into that ciphertext block if its integrity is notprotected. The same property also holds for the ciphertext segments in the CFB mode; however,for every ciphertext segment except the last one, the existence of such bit errors may be detectedby their randomizing effect on the decryption of the succeeding ciphertext segment.

21

Table D.1 summarizes the effects of bit errors in a ciphertext block or IV on the decryption of theciphertext for each of the five confidentiality modes.
Table D.1e five confidentiality modes.
Table D.2: Summary of Effect of Bit Errors on Decryption
Mode
Effect of Bit Errors in Cj
ECB RBE in the decryption of Cj
CBC
CFB
OFB
CTR

Effect of Bit Errors in the IV
Not applicableRBE in the decryption of Cj
SBE in the decryption of Cj+1
SBE in the decryption of Cj
RBE in the decryption of Cj+1,…,Cj+b/s
SBE in the decryption of Cj

RBE in the decryption of C1, C2, …, Cj
for some j between 1 and b/s
RBE in the decryption of C1, C2, …, Cn

SBE in the decryption of Cj

Not applicable *SBE in the decryption of C1

RBE: random bit errors, i.e., bit errors occur independently in any bit position with an
expected probability of ½.
SBE: specific bit errors, i.e., bit errors occur in the same bit position(s) as the original bit
error(s).
* Bit errors in the jth counter block, Tj, result in RBE in the decryption of Cj.

The deletion or insertion of bits into a ciphertext block (or segment) spoils the synchronization of
the block (or segment) boundaries; in effect, bit errors may occur in the bit position of theinserted or deleted bit, and in every subsequent bit position. Therefore, the decryptions of thesubsequent ciphertext blocks (or segments) will almost certainly be incorrect until thesynchronization is restored. When the 1-bit CFB mode is used, then the synchronization is
automatically restored b+1 positions after the inserted or deleted bit. For other values of s in the
CFB mode, and for the other confidentiality modes in this recommendation, the synchronizationmust be restored externally.

22

Appendix E: Modes of Triple DESFIPS Pub 46-3 [FIPS 46-3] specifies the Data Encryption Standard (DES) algorithm andapproves its three-fold, compound operation that is specified in ANSI X9.52 [1]: the Triple Data
Encryption Algorithm (TDEA). Essentially, the TDEA consists of the application of the forward
DES algorithm, i.e, DES encryption, under one key, followed by the application of the inverse
DES algorithm, i.e., DES decryption, under a second key, followed by the application of theforward DES algorithm under a third key. The TDEA is often called Triple DES.
FIPS Pub 46-3 also approves the seven modes of operation of Triple DES that are specified in
ANSI X9.52. Four of those modes are equivalent to modes in this recommendation with the
TDEA as the underlying block cipher. In particular, the TECB, TCBC, and TOFB modes in
ANSI X9.52 are equivalent to the ECB, CBC, and OFB modes in this recommendation, with the
TDEA as the underlying block cipher; the TCFB mode in ANSI X9.52 is equivalent to the CFB
mode in this recommendation, with the TDEA as the underlying block cipher, provided that thepossible choices of the parameter s (the segment size) are restricted to three values: 1, 8, and 64.
The remaining three modes in ANSI X9.52 are TCBC-I, TCFB-P, and TOFB-I; they are mode
variants that allow for interleaving or pipelining; this recommendation does not provide
analogues of these three modes.
The Triple DES modes in ANSI X9.52 should not be used as the underlying block cipher
algorithm for the modes in this recommendation. However, the Triple DES algorithm, i.e.,
TDEA, as described above, may be used as the underlying block cipher algorithm for the sixmodes in this recommendation. One of the resulting modes of Triple DES is new, i.e., notspecified in ANSI X9.52: the CTR mode of the TDEA.

23

Appendix F: Example Vectors for Modes of Operation of the AES
In this appendix, three examples are provided for each of the modes in this recommendation with
the AES algorithm [2] as the underlying block cipher: one example is given for each of theallowed key sizes (128, 192, and 256 bits). Some intermediate results are presented. For the fiveconfidentiality modes, examples are provided for both encryption and decryption. Examples areprovided for 1-bit, 8-bit, and 128 bit CFB. The plaintext for all but two of these examples is
equivalent to the following string of hexadecimal characters, formatted into four 128 bit blocks:
6bc1bee22e409f96e93d7e117393172a
ae2d8a571e03ac9c9eb76fac45af8e51
30c81c46a35ce411e5fbc1191a0a52ef
f69f2445df4f9b17ad2b417be66c3710.
For the example of 1-bit CFB, the plaintext is the first 16 bits in the above string; for the exampleof 8-bit CFB, the plaintext is the first 18 octets in the above string. All strings are presented inhexadecimal notation, except in the example of 1-bit CFB, where the plaintext and ciphertext
segments are single bits.
F.1

ECB Example Vectors

F.1.1
ECB-AES128.EncryptKey2b7e151628aed2a6abf7158809cf4f3c
Block #1
Plaintext
6bc1bee22e409f96e93d7e117393172a
Input Block6bc1bee22e409f96e93d7e117393172a
Output Block3ad77bb40d7a3660a89ecaf32466ef97
Ciphertext
3ad77bb40d7a3660a89ecaf32466ef97
Block #2
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Input Blockae2d8a571e03ac9c9eb76fac45af8e51
Output Blockf5d3d58503b9699de785895a96fdbaaf
Ciphertext
f5d3d58503b9699de785895a96fdbaaf
Block #3
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Input Block
30c81c46a35ce411e5fbc1191a0a52ef
Output Block43b1cd7f598ece23881b00e3ed030688
Ciphertext
43b1cd7f598ece23881b00e3ed030688
Block #4
Plaintext
f69f2445df4f9b17ad2b417be66c3710
Input Blockf69f2445df4f9b17ad2b417be66c3710
Output Block7b0c785e27e8ad3f8223207104725dd4
Ciphertext
7b0c785e27e8ad3f8223207104725dd4
F.1.2
ECB-AES128.DecryptKey2b7e151628aed2a6abf7158809cf4f3c
Block #1
Ciphertext
3ad77bb40d7a3660a89ecaf32466ef97
Input Block3ad77bb40d7a3660a89ecaf32466ef97

24

Output Block
Plaintext
Block #2
Ciphertext
Input Block
Output Block
Plaintext
Block #3
Ciphertext
Input Block
Output Block
Plaintext
Block #4
Ciphertext
Input Block
Output Block
Plaintext

6bc1bee22e409f96e93d7e117393172a
6bc1bee22e409f96e93d7e117393172a
f5d3d58503b9699de785895a96fdbaaf
f5d3d58503b9699de785895a96fdbaaf
ae2d8a571e03ac9c9eb76fac45af8e51
ae2d8a571e03ac9c9eb76fac45af8e51
43b1cd7f598ece23881b00e3ed030688
43b1cd7f598ece23881b00e3ed030688
30c81c46a35ce411e5fbc1191a0a52ef
30c81c46a35ce411e5fbc1191a0a52ef
7b0c785e27e8ad3f8223207104725dd4
7b0c785e27e8ad3f8223207104725dd4
f69f2445df4f9b17ad2b417be66c3710
f69f2445df4f9b17ad2b417be66c3710

F.1.3
ECB-AES192.EncryptKey8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7bBlock #1
Plaintext
6bc1bee22e409f96e93d7e117393172a
Input Block6bc1bee22e409f96e93d7e117393172a
Output Blockbd334f1d6e45f25ff712a214571fa5cc
Ciphertext
bd334f1d6e45f25ff712a214571fa5cc
Block #2
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Input Blockae2d8a571e03ac9c9eb76fac45af8e51
Output Block974104846d0ad3ad7734ecb3ecee4eef
Ciphertext
974104846d0ad3ad7734ecb3ecee4eef
Block #3
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Input Block
30c81c46a35ce411e5fbc1191a0a52ef
Output Blockef7afd2270e2e60adce0ba2face6444e
Ciphertext
ef7afd2270e2e60adce0ba2face6444e
Block #4
Plaintext
f69f2445df4f9b17ad2b417be66c3710
Input Blockf69f2445df4f9b17ad2b417be66c3710
Output Block
9a4b41ba738d6c72fb16691603c18e0e
Ciphertext
9a4b41ba738d6c72fb16691603c18e0e
F.1.4
ECB-AES192.DecryptKey8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7bBlock #1
Ciphertext
bd334f1d6e45f25ff712a214571fa5cc
Input Blockbd334f1d6e45f25ff712a214571fa5cc
Output Block6bc1bee22e409f96e93d7e117393172a
Plaintext
6bc1bee22e409f96e93d7e117393172a
Block #2
Ciphertext
974104846d0ad3ad7734ecb3ecee4eef
Input Block974104846d0ad3ad7734ecb3ecee4eef
Output Blockae2d8a571e03ac9c9eb76fac45af8e51
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51

25

Block #3
Ciphertext
Input Block
Output Block
Plaintext
Block #4
Ciphertext
Input Block
Output Block
Plaintext

ef7afd2270e2e60adce0ba2face6444e
ef7afd2270e2e60adce0ba2face6444e
30c81c46a35ce411e5fbc1191a0a52ef
30c81c46a35ce411e5fbc1191a0a52ef
9a4b41ba738d6c72fb16691603c18e0e
9a4b41ba738d6c72fb16691603c18e0e
f69f2445df4f9b17ad2b417be66c3710
f69f2445df4f9b17ad2b417be66c3710

F.1.5
Key

ECB-AES256.Encrypt603deb1015ca71be2b73aef0857d7781
1f352c073b6108d72d9810a30914dff4
Block #1
Plaintext
6bc1bee22e409f96e93d7e117393172a
Input Block6bc1bee22e409f96e93d7e117393172a
Output Blockf3eed1bdb5d2a03c064b5a7e3db181f8
Ciphertext
f3eed1bdb5d2a03c064b5a7e3db181f8
Block #2
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Input Blockae2d8a571e03ac9c9eb76fac45af8e51
Output Block
591ccb10d410ed26dc5ba74a31362870
Ciphertext
591ccb10d410ed26dc5ba74a31362870
Block #3
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Input Block
30c81c46a35ce411e5fbc1191a0a52ef
Output Blockb6ed21b99ca6f4f9f153e7b1beafed1d
Ciphertext
b6ed21b99ca6f4f9f153e7b1beafed1d
Block #4
Plaintext
f69f2445df4f9b17ad2b417be66c3710
Input Blockf69f2445df4f9b17ad2b417be66c3710
Output Block
23304b7a39f9f3ff067d8d8f9e24ecc7
Ciphertext
23304b7a39f9f3ff067d8d8f9e24ecc7
F.1.6
Key

ECB-AES256.Decrypt603deb1015ca71be2b73aef0857d7781
1f352c073b6108d72d9810a30914dff4
Block #1
Ciphertext
f3eed1bdb5d2a03c064b5a7e3db181f8
Input Blockf3eed1bdb5d2a03c064b5a7e3db181f8
Output Block6bc1bee22e409f96e93d7e117393172a
Plaintext
6bc1bee22e409f96e93d7e117393172a
Block #2
Ciphertext
591ccb10d410ed26dc5ba74a31362870
Input Block
591ccb10d410ed26dc5ba74a31362870
Output Blockae2d8a571e03ac9c9eb76fac45af8e51
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Block #3
Ciphertext
b6ed21b99ca6f4f9f153e7b1beafed1d
Input Blockb6ed21b99ca6f4f9f153e7b1beafed1d
Output Block
30c81c46a35ce411e5fbc1191a0a52ef
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef

26

Block #4
Ciphertext
Input Block
Output Block
Plaintext
F.2

23304b7a39f9f3ff067d8d8f9e24ecc7
23304b7a39f9f3ff067d8d8f9e24ecc7
f69f2445df4f9b17ad2b417be66c3710
f69f2445df4f9b17ad2b417be66c3710

CBC Example Vectors

F.2.1
CBC-AES128.EncryptKey2b7e151628aed2a6abf7158809cf4f3c
IV000102030405060708090a0b0c0d0e0f
Block #1
Plaintext
6bc1bee22e409f96e93d7e117393172a
Input Block6bc0bce12a459991e134741a7f9e1925
Output Block7649abac8119b246cee98e9b12e9197d
Ciphertext
7649abac8119b246cee98e9b12e9197d
Block #2
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Input Blockd86421fb9f1a1eda505ee1375746972c
Output Block
5086cb9b507219ee95db113a917678b2
Ciphertext
5086cb9b507219ee95db113a917678b2
Block #3
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Input Block604ed7ddf32efdff7020d0238b7c2a5d
Output Block73bed6b8e3c1743b7116e69e22229516
Ciphertext
73bed6b8e3c1743b7116e69e22229516
Block #4
Plaintext
f69f2445df4f9b17ad2b417be66c3710
Input Block
8521f2fd3c8eef2cdc3da7e5c44ea206
Output Block3ff1caa1681fac09120eca307586e1a7
Ciphertext
3ff1caa1681fac09120eca307586e1a7
F.2.2
CBC-AES128.DecryptKey2b7e151628aed2a6abf7158809cf4f3c
IV000102030405060708090a0b0c0d0e0f
Block #1
Ciphertext
7649abac8119b246cee98e9b12e9197d
Input Block7649abac8119b246cee98e9b12e9197d
Output Block6bc0bce12a459991e134741a7f9e1925
Plaintext
6bc1bee22e409f96e93d7e117393172a
Block #2
Ciphertext
5086cb9b507219ee95db113a917678b2
Input Block
5086cb9b507219ee95db113a917678b2
Output Blockd86421fb9f1a1eda505ee1375746972c
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Block #3
Ciphertext
73bed6b8e3c1743b7116e69e22229516
Input Block73bed6b8e3c1743b7116e69e22229516
Output Block604ed7ddf32efdff7020d0238b7c2a5d
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Block #4
Ciphertext
3ff1caa1681fac09120eca307586e1a7
Input Block3ff1caa1681fac09120eca307586e1a7

27

Output Block
Plaintext

8521f2fd3c8eef2cdc3da7e5c44ea206
f69f2445df4f9b17ad2b417be66c3710

F.2.3
CBC-AES192.EncryptKey8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7bIV000102030405060708090a0b0c0d0e0f
Block #1
Plaintext
6bc1bee22e409f96e93d7e117393172a
Input Block6bc0bce12a459991e134741a7f9e1925
Output Block
4f021db243bc633d7178183a9fa071e8
Ciphertext
4f021db243bc633d7178183a9fa071e8
Block #2
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Input Blocke12f97e55dbfcfa1efcf7796da0fffb9
Output Blockb4d9ada9ad7dedf4e5e738763f69145a
Ciphertext
b4d9ada9ad7dedf4e5e738763f69145a
Block #3
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Input Block8411b1ef0e2109e5001cf96f256346b5
Output Block571b242012fb7ae07fa9baac3df102e0
Ciphertext
571b242012fb7ae07fa9baac3df102e0
Block #4
Plaintext
f69f2445df4f9b17ad2b417be66c3710
Input Blocka1840065cdb4e1f7d282fbd7db9d35f0
Output Block08b0e27988598881d920a9e64f5615cd
Ciphertext
08b0e27988598881d920a9e64f5615cd
F.2.4
CBC-AES192.DecryptKey8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7bIV000102030405060708090a0b0c0d0e0f
Block #1
Ciphertext
4f021db243bc633d7178183a9fa071e8
Input Block
4f021db243bc633d7178183a9fa071e8
Output Block6bc0bce12a459991e134741a7f9e1925
Plaintext
6bc1bee22e409f96e93d7e117393172a
Block #2
Ciphertext
b4d9ada9ad7dedf4e5e738763f69145a
Input Blockb4d9ada9ad7dedf4e5e738763f69145a
Output Blocke12f97e55dbfcfa1efcf7796da0fffb9
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Block #3
Ciphertext
571b242012fb7ae07fa9baac3df102e0
Input Block571b242012fb7ae07fa9baac3df102e0
Output Block8411b1ef0e2109e5001cf96f256346b5
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Block #4
Ciphertext
08b0e27988598881d920a9e64f5615cd
Input Block08b0e27988598881d920a9e64f5615cd
Output Blocka1840065cdb4e1f7d282fbd7db9d35f0
Plaintext
f69f2445df4f9b17ad2b417be66c3710
F.2.5
Key

CBC-AES256.Encrypt603deb1015ca71be2b73aef0857d7781

28

IV
Block #1
Plaintext
Input Block
Output Block
Ciphertext
Block #2
Plaintext
Input Block
Output Block
Ciphertext
Block #3
Plaintext
Input Block
Output Block
Ciphertext
Block #4
Plaintext
Input Block
Output Block
Ciphertext

1f352c073b6108d72d9810a30914dff4000102030405060708090a0b0c0d0e0f
6bc1bee22e409f96e93d7e117393172a
6bc0bce12a459991e134741a7f9e1925
f58c4c04d6e5f1ba779eabfb5f7bfbd6
f58c4c04d6e5f1ba779eabfb5f7bfbd6
ae2d8a571e03ac9c9eb76fac45af8e51
5ba1c653c8e65d26e929c4571ad47587
9cfc4e967edb808d679f777bc6702c7d
9cfc4e967edb808d679f777bc6702c7d
30c81c46a35ce411e5fbc1191a0a52ef
ac3452d0dd87649c8264b662dc7a7e92
39f23369a9d9bacfa530e26304231461
39f23369a9d9bacfa530e26304231461
f69f2445df4f9b17ad2b417be66c3710
cf6d172c769621d8081ba318e24f2371
b2eb05e2c39be9fcda6c19078c6a9d1bb2eb05e2c39be9fcda6c19078c6a9d1b

F.2.6
Key

CBC-AES256.Decrypt603deb1015ca71be2b73aef0857d7781
1f352c073b6108d72d9810a30914dff4IV000102030405060708090a0b0c0d0e0f
Block #1
Ciphertext
f58c4c04d6e5f1ba779eabfb5f7bfbd6
Input Blockf58c4c04d6e5f1ba779eabfb5f7bfbd6
Output Block6bc0bce12a459991e134741a7f9e1925
Plaintext
6bc1bee22e409f96e93d7e117393172a
Block #2
Ciphertext
9cfc4e967edb808d679f777bc6702c7d
Input Block9cfc4e967edb808d679f777bc6702c7d
Output Block5ba1c653c8e65d26e929c4571ad47587
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Block #3
Ciphertext
39f23369a9d9bacfa530e26304231461
Input Block39f23369a9d9bacfa530e26304231461
Output Blockac3452d0dd87649c8264b662dc7a7e92
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Block #4
Ciphertext
b2eb05e2c39be9fcda6c19078c6a9d1b
Input Blockb2eb05e2c39be9fcda6c19078c6a9d1b
Output Blockcf6d172c769621d8081ba318e24f2371
Plaintext
f69f2445df4f9b17ad2b417be66c3710
F.3
F.3.1
Key
IV

CFB Example Vectors
CFB1-AES128.Encrypt2b7e151628aed2a6abf7158809cf4f3c
000102030405060708090a0b0c0d0e0f

29

Segment #1
Input Block
Output Block
Plaintext
Ciphertext
Segment #2
Input Block
Output Block
Plaintext
Ciphertext
Segment #3
Input Block
Output Block
Plaintext
Ciphertext
Segment #4
Input Block
Output Block
Plaintext
Ciphertext
Segment #5
Input Block
Output Block
Plaintext
Ciphertext
Segment #6
Input Block
Output Block
Plaintext
Ciphertext
Segment #7
Input Block
Output Block
Plaintext
Ciphertext
Segment #8
Input Block
Output Block
Plaintext
Ciphertext
Segment #9
Input Block
Output Block
Plaintext
Ciphertext
Segment #10
Input Block
Output Block
Plaintext
Ciphertext
Segment #11
Input Block
Output Block
Plaintext

000102030405060708090a0b0c0d0e0f
50fe67cc996d32b6da0937e99bafec60
0000020406080a0c0e10121416181a1c1e
19cf576c7596e702f298b35666955c79
1
10004080c1014181c2024282c3034383d
59e17759acd02b801fa321ea059e331f
1
10008101820283038404850586068707b
71f415b0cc109e8b0faa14ab740c22f4
0000102030405060708090a0b0c0d0e0f6
3fb76d3d1048179964597a0f64d5adad
1
10020406080a0c0e10121416181a1c1ed
4c943b4bac54ab974e3e52326d29aaa100004080c1014181c2024282c3034383da
c94da41eb3d3acf1993a512ab1e8203f
1
0008101820283038404850586068707b4
e07f5e98778f75dbb2691c3f582c3953
100102030405060708090a0b0c0d0e0f68
02ef5fc8961efcce8568bc0731262dc7
11020406080a0c0e10121416181a1c1ed1
9f5a30367065efbe914b53698c8716b7
1004080c1014181c2024282c3034383da2
d018cfb81d0580edbff955ed74d382db
030

Ciphertext
Segment #12
Input Block
Output Block
Plaintext
Ciphertext
Segment #13
Input Block
Output Block
Plaintext
Ciphertext
Segment #14
Input Block
Output Block
Plaintext
Ciphertext
Segment #15
Input Block
Output Block
Plaintext
Ciphertext
Segment #16
Input Block
Output Block
Plaintext
Ciphertext

1
08101820283038404850586068707b45
81272ab351e08e0b695b94b8164d86f4
01102030405060708090a0b0c0d0e0f68b
094d33f856483d3fa01ba94f7e5ab3e70020406080a0c0e10121416181a1c1ed16
609900ad61923c8c102cd8d0d7947a2c
004080c1014181c2024282c3034383da2c
9e5a154de966ab4db9c88b22a398134e
01
8101820283038404850586068707b459
7fe16252b338bc4de3725c4156dfed20
1
1

F.3.2
CFB1-AES128.DecryptKey2b7e151628aed2a6abf7158809cf4f3c
IV000102030405060708090a0b0c0d0e0f
Segment #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Block
50fe67cc996d32b6da0937e99bafec60
Ciphertext
0
Plaintext
0
Segment #2
Input Block
00020406080a0c0e10121416181a1c1e
Output Block19cf576c7596e702f298b35666955c79
Ciphertext
1
Plaintext
1
Segment #3
Input Block
0004080c1014181c2024282c3034383d
Output Block59e17759acd02b801fa321ea059e331f
Ciphertext
1
Plaintext
1
Segment #4
Input Block
0008101820283038404850586068707b
Output Block
71f415b0cc109e8b0faa14ab740c22f4
Ciphertext
0
Plaintext
0
Segment #5
Input Block
00102030405060708090a0b0c0d0e0f6
Output Block3fb76d3d1048179964597a0f64d5adad

31

Ciphertext
Plaintext
Segment #6
Input Block
Output Block
Ciphertext
Plaintext
Segment #7
Input Block
Output Block
Ciphertext
Plaintext
Segment #8
Input Block
Output Block
Ciphertext
Plaintext
Segment #9
Input Block
Output Block
Ciphertext
Plaintext
Segment #10
Input Block
Output Block
Ciphertext
Plaintext
Segment #11
Input Block
Output Block
Ciphertext
Plaintext
Segment #12
Input Block
Output Block
Ciphertext
Plaintext
Segment #13
Input Block
Output Block
Ciphertext
Plaintext
Segment #14
Input Block
Output Block
Ciphertext
Plaintext
Segment #15
Input Block
Output Block
Ciphertext
Plaintext
Segment #16
Input Block1
10020406080a0c0e10121416181a1c1ed
4c943b4bac54ab974e3e52326d29aaa100004080c1014181c2024282c3034383da
c94da41eb3d3acf1993a512ab1e8203f
0
1008101820283038404850586068707b4
e07f5e98778f75dbb2691c3f582c3953
010102030405060708090a0b0c0d0e0f68
02ef5fc8961efcce8568bc0731262dc7
11020406080a0c0e10121416181a1c1ed1
9f5a30367065efbe914b53698c8716b7
0104080c1014181c2024282c3034383da2
d018cfb81d0580edbff955ed74d382db
1
008101820283038404850586068707b45
81272ab351e08e0b695b94b8164d86f4
10102030405060708090a0b0c0d0e0f68b
094d33f856483d3fa01ba94f7e5ab3e70020406080a0c0e10121416181a1c1ed16
609900ad61923c8c102cd8d0d7947a2c
004080c1014181c2024282c3034383da2c
9e5a154de966ab4db9c88b22a398134e
108101820283038404850586068707b459

32

Output Block
Ciphertext
Plaintext

7fe16252b338bc4de3725c4156dfed20
1
1

F.3.3
CFB1-AES192.EncryptKey8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7bIV000102030405060708090a0b0c0d0e0f
Segment #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Blocka609b38df3b1133dddff2718ba09565e
Plaintext0
Ciphertext
1
Segment #2
Input Block
00020406080a0c0e10121416181a1c1f
Output Blocka0e2bee6eb1734379bd4908be6a991a0
Plaintext
1
Ciphertext
0
Segment #3
Input Block
0004080c1014181c2024282c3034383e
Output Blockb1a1766bedec7ee3ba9cd3f34fbed4c6
Plaintext
1
Ciphertext
0
Segment #4
Input Block
0008101820283038404850586068707c
Output Blockb294ae5f393ae0179e6d3d8c45a7a4b9
Plaintext0
Ciphertext
1
Segment #5
Input Block
00102030405060708090a0b0c0d0e0f9
Output Blockf0f703ff5d0634aa8aee7f1e26aafca3
Plaintext
1
Ciphertext
0
Segment #6
Input Block0020406080a0c0e10121416181a1c1f2
Output Block
4d67df426abdb8c89e7de9fb3069d8be
Plaintext0
Ciphertext
0
Segment #7
Input Block
004080c1014181c2024282c3034383e4
Output Block30bc892338dfa10664118b9f4ba348d2
Plaintext
1
Ciphertext
1
Segment #8
Input Block008101820283038404850586068707c9
Output Block763ad8c63ed78d66452bb44c8bb7a8c8
Plaintext
1
Ciphertext
1
Segment #9
Input Block
0102030405060708090a0b0c0d0e0f93
Output Blockbfc36f5cfbc1306859b48f8fa62a43df
Plaintext
1
Ciphertext
0
Segment #10

33

Input Block
Output Block
Plaintext
Ciphertext
Segment #11
Input Block
Output Block
Plaintext
Ciphertext
Segment #12
Input Block
Output Block
Plaintext
Ciphertext
Segment #13
Input Block
Output Block
Plaintext
Ciphertext
Segment #14
Input Block
Output Block
Plaintext
Ciphertext
Segment #15
Input Block
Output Block
Plaintext
Ciphertext
Segment #16
Input Block
Output Block
Plaintext
Ciphertext

020406080a0c0e10121416181a1c1f26
16e27adac112a0bf6a69c95cbdf584a3
1
104080c1014181c2024282c3034383e4d
1e9d21c3da3de9186251160045756ce00008101820283038404850586068707c9a
b836e0f661b51d8bd38c448e0e5a11bb
0
1102030405060708090a0b0c0d0e0f935
c5efcdd09dbb92d1faada8f6c9bab052
0120406080a0c0e10121416181a1c1f26b
7c99710018d88e40bd4ac8f1b2bf4dbb
004080c1014181c2024282c3034383e4d6
173bcd8b4dad60ae6646813fdcb81f5b
008101820283038404850586068707c9ac
09844c6d2272d148d5af1c7bf01bb439
1
1

F.3.4
CFB1-AES192.DecryptKey8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7bIV000102030405060708090a0b0c0d0e0f
Segment #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Blocka609b38df3b1133dddff2718ba09565e
Ciphertext
1
Plaintext
0
Segment #2
Input Block
00020406080a0c0e10121416181a1c1f
Output Blocka0e2bee6eb1734379bd4908be6a991a0
Ciphertext
0
Plaintext
1
Segment #3
Input Block
0004080c1014181c2024282c3034383e
Output Blockb1a1766bedec7ee3ba9cd3f34fbed4c6
Ciphertext
0
Plaintext
1

34

Segment #4
Input Block
Output Block
Ciphertext
Plaintext
Segment #5
Input Block
Output Block
Ciphertext
Plaintext
Segment #6
Input Block
Output Block
Ciphertext
Plaintext
Segment #7
Input Block
Output Block
Ciphertext
Plaintext
Segment #8
Input Block
Output Block
Ciphertext
Plaintext
Segment #9
Input Block
Output Block
Ciphertext
Plaintext
Segment #10
Input Block
Output Block
Ciphertext
Plaintext
Segment #11
Input Block
Output Block
Ciphertext
Plaintext
Segment #12
Input Block
Output Block
Ciphertext
Plaintext
Segment #13
Input Block
Output Block
Ciphertext
Plaintext
Segment #14
Input Block
Output Block
Ciphertext

0008101820283038404850586068707c
b294ae5f393ae0179e6d3d8c45a7a4b9
1
000102030405060708090a0b0c0d0e0f9
f0f703ff5d0634aa8aee7f1e26aafca30
10020406080a0c0e10121416181a1c1f2
4d67df426abdb8c89e7de9fb3069d8be00004080c1014181c2024282c3034383e4
30bc892338dfa10664118b9f4ba348d2
1
1008101820283038404850586068707c9
763ad8c63ed78d66452bb44c8bb7a8c8
1
10102030405060708090a0b0c0d0e0f93
bfc36f5cfbc1306859b48f8fa62a43df
01020406080a0c0e10121416181a1c1f26
16e27adac112a0bf6a69c95cbdf584a3
1
104080c1014181c2024282c3034383e4d
1e9d21c3da3de9186251160045756ce00008101820283038404850586068707c9a
b836e0f661b51d8bd38c448e0e5a11bb
1
0102030405060708090a0b0c0d0e0f935
c5efcdd09dbb92d1faada8f6c9bab052
1020406080a0c0e10121416181a1c1f26b
7c99710018d88e40bd4ac8f1b2bf4dbb
035

Plaintext
Segment #15
Input Block
Output Block
Ciphertext
Plaintext
Segment #16
Input Block
Output Block
Ciphertext
Plaintext

04080c1014181c2024282c3034383e4d6
173bcd8b4dad60ae6646813fdcb81f5b
008101820283038404850586068707c9ac
09844c6d2272d148d5af1c7bf01bb439
1
1

F.3.5
Key

CFB1-AES256.Encrypt603deb1015ca71be2b73aef0857d7781
1f352c073b6108d72d9810a30914dff4IV000102030405060708090a0b0c0d0e0f
Segment #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Blockb7bf3a5df43989dd97f0fa97ebce2f4a
Plaintext0
Ciphertext
1
Segment #2
Input Block
00020406080a0c0e10121416181a1c1f
Output Blockee93d380e0f01117fffd78017599514a
Plaintext
1
Ciphertext
0
Segment #3
Input Block
0004080c1014181c2024282c3034383e
Output Block857749898b3602aad91e699911de89b0
Plaintext
1
Ciphertext
0
Segment #4
Input Block
0008101820283038404850586068707c
Output Block
dce81c80810e2ba343a6bb402716b7a8
Plaintext0
Ciphertext
1
Segment #5
Input Block
00102030405060708090a0b0c0d0e0f9
Output Blocke5517bfcdccea00501350a601f754823
Plaintext
1
Ciphertext
0
Segment #6
Input Block0020406080a0c0e10121416181a1c1f2
Output Block
15799c7f4081a78cc41f29955349c5a0
Plaintext0
Ciphertext
0
Segment #7
Input Block
004080c1014181c2024282c3034383e4
Output Block
84d246bdb391f6a7979ff5ccb8467262
Plaintext
1
Ciphertext
0
Segment #8
Input Block008101820283038404850586068707c8

36Output Block
Plaintext
Ciphertext
Segment #9
Input Block
Output Block
Plaintext
Ciphertext
Segment #10
Input Block
Output Block
Plaintext
Ciphertext
Segment #11
Input Block
Output Block
Plaintext
Ciphertext
Segment #12
Input Block
Output Block
Plaintext
Ciphertext
Segment #13
Input Block
Output Block
Plaintext
Ciphertext
Segment #14
Input Block
Output Block
Plaintext
Ciphertext
Segment #15
Input Block
Output Block
Plaintext
Ciphertext
Segment #16
Input Block
Output Block
Plaintext
Ciphertext

bb9e05db9855a9e7e3837a648dd4c3b0100102030405060708090a0b0c0d0e0f90
a413c5714f70287dfcd943004bf7ac8e
10020406080a0c0e10121416181a1c1f20
a7310abf87610d66edf6c892a84460d5
1004080c1014181c2024282c3034383e40
8aec6712d89bd147c83b51d787b11399
0108101820283038404850586068707c81
2ff05b620f68134f4ba92deffbfc93b2
00102030405060708090a0b0c0d0e0f902
819208afd5284316065a76bead028ad3
0120406080a0c0e10121416181a1c1f205
1914ed64b2115167ce2ca4c813da5245
004080c1014181c2024282c3034383e40a
638abae8724a954ae9e1e2e119deb6e1008101820283038404850586068707c814
2b4f488a3f958c52a3f1db2da938360e
1
1

F.3.6
Key

CFB1-AES256.Decrypt603deb1015ca71be2b73aef0857d7781
1f352c073b6108d72d9810a30914dff4IV000102030405060708090a0b0c0d0e0f
Segment #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Blockb7bf3a5df43989dd97f0fa97ebce2f4a
Ciphertext
1
Plaintext
037

Segment #2
Input Block
Output Block
Ciphertext
Plaintext
Segment #3
Input Block
Output Block
Ciphertext
Plaintext
Segment #4
Input Block
Output Block
Ciphertext
Plaintext
Segment #5
Input Block
Output Block
Ciphertext
Plaintext
Segment #6
Input Block
Output Block
Ciphertext
Plaintext
Segment #7
Input Block
Output Block
Ciphertext
Plaintext
Segment #8
Input Block
Output Block
Ciphertext
Plaintext
Segment #9
Input Block
Output Block
Ciphertext
Plaintext
Segment #10
Input Block
Output Block
Ciphertext
Plaintext
Segment #11
Input Block
Output Block
Ciphertext
Plaintext
Segment #12
Input Block
Output Block
Ciphertext

00020406080a0c0e10121416181a1c1f
ee93d380e0f01117fffd78017599514a
010004080c1014181c2024282c3034383e
857749898b3602aad91e699911de89b0010008101820283038404850586068707c
dce81c80810e2ba343a6bb402716b7a8
1
000102030405060708090a0b0c0d0e0f9
e5517bfcdccea00501350a601f754823
010020406080a0c0e10121416181a1c1f2
15799c7f4081a78cc41f29955349c5a000004080c1014181c2024282c3034383e4
84d246bdb391f6a7979ff5ccb8467262
0
1008101820283038404850586068707c8
bb9e05db9855a9e7e3837a648dd4c3b0010102030405060708090a0b0c0d0e0f90
a413c5714f70287dfcd943004bf7ac8e
01020406080a0c0e10121416181a1c1f20
a7310abf87610d66edf6c892a84460d5
0104080c1014181c2024282c3034383e40
8aec6712d89bd147c83b51d787b11399
1008101820283038404850586068707c81
2ff05b620f68134f4ba92deffbfc93b2
038

Plaintext
Segment #13
Input Block
Output Block
Ciphertext
Plaintext
Segment #14
Input Block
Output Block
Ciphertext
Plaintext 0
Segment #15
Input Block
Output Block
Ciphertext
Plaintext
Segment #16
Input Block
Output Block
Ciphertext
Plaintext

0102030405060708090a0b0c0d0e0f902
819208afd5284316065a76bead028ad3
1020406080a0c0e10121416181a1c1f205
1914ed64b2115167ce2ca4c813da5245
04080c1014181c2024282c3034383e40a
638abae8724a954ae9e1e2e119deb6e1008101820283038404850586068707c814
2b4f488a3f958c52a3f1db2da938360e
1
1

F.3.7
CFB8-AES128.EncryptKey2b7e151628aed2a6abf7158809cf4f3c
IV000102030405060708090a0b0c0d0e0f
Segment #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Block
50fe67cc996d32b6da0937e99bafec60
Plaintext
6b
Ciphertext
3b
Segment #2
Input Block
0102030405060708090a0b0c0d0e0f3b
Output Blockb8eb865a2b026381abb1d6560ed20f68
Plaintext
c1
Ciphertext
79
Segment #3
Input Block
02030405060708090a0b0c0d0e0f3b79
Output Blockfce6033b4edce64cbaed3f61ff5b927c
Plaintext
beCiphertext
42
Segment #4
Input Block
030405060708090a0b0c0d0e0f3b7942
Output Blockae4e5e7ffe805f7a4395b180004f8ca8
Plaintext
e2
Ciphertext
4c
Segment #5
Input Block
0405060708090a0b0c0d0e0f3b79424c
Output Blockb205eb89445b62116f1deb988a81e6dd
Plaintext
2e
Ciphertext
9c
Segment #6
Input Block
05060708090a0b0c0d0e0f3b79424c9c
Output Block
4d21d456a5e239064fff4be0c0f85488

39

Plaintext
Ciphertext
Segment #7
Input Block
Output Block
Plaintext
Ciphertext
Segment #8
Input Block
Output Block
Plaintext
Ciphertext
Segment #9
Input Block
Output Block
Plaintext
Ciphertext
Segment #10
Input Block
Output Block
Plaintext
Ciphertext
Segment #11
Input Block
Output Block
Plaintext
Ciphertext
Segment #12
Input Block
Output Block
Plaintext
Ciphertext
Segment #13
Input Block
Output Block
Plaintext
Ciphertext
Segment #14
Input Block
Output Block
Plaintext
Ciphertext
Segment #15
Input Block
Output Block
Plaintext
Ciphertext
Segment #16
Input Block
Output Block
Plaintext
Ciphertext
Segment #17
Input Block400d060708090a0b0c0d0e0f3b79424c9c0d4b2f5c3895b9efdc85ee0c5178c7fd33
9fd4
0708090a0b0c0d0e0f3b79424c9c0dd4
a0976d856da260a34104d1a80953db4c
963608090a0b0c0d0e0f3b79424c9c0dd436
53674e5890a2c71b0f6a27a094e5808c
e9ba
090a0b0c0d0e0f3b79424c9c0dd436ba
f34cd32ffed495f8bc8adba194eccb7a3dce
0a0b0c0d0e0f3b79424c9c0dd436bace
e08cf2407d7ed676c9049586f1d48ba6
7e
9e
0b0c0d0e0f3b79424c9c0dd436bace9e
1f5c88a19b6ca28e99c9aeb8982a6dd8
110e
0c0d0e0f3b79424c9c0dd436bace9e0e
a70e63df781cf395a208bd2365c8779b73
d4
0d0e0f3b79424c9c0dd436bace9e0ed4
cbcfe8b3bcf9ac202ce18420013319ab
93
58
0e0f3b79424c9c0dd436bace9e0ed458
7d9fac6604b3c8c5b1f8c5a00956cf56
17
6a
0f3b79424c9c0dd436bace9e0ed4586a
65c3fa64bf0343986825c636f4a1efd2
2a4f
3b79424c9c0dd436bace9e0ed4586a4f

40

Output Block
Plaintext
Ciphertext
Segment #18
Input Block
Output Block
Plaintext
Ciphertext

9cff5e5ff4f554d56c924b9d6a6de21dae
3279424c9c0dd436bace9e0ed4586a4f32
946c3dc1584cc18400ecd8c6052c44b1
2d
b9

F.3.8
CFB8-AES128.DecryptKey2b7e151628aed2a6abf7158809cf4f3c
IV000102030405060708090a0b0c0d0e0f
Segment #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Block
50fe67cc996d32b6da0937e99bafec60
Ciphertext
3b
Plaintext
6b
Segment #2
Input Block
0102030405060708090a0b0c0d0e0f3b
Output Blockb8eb865a2b026381abb1d6560ed20f68
Ciphertext
79
Plaintext
c1
Segment #3
Input Block
02030405060708090a0b0c0d0e0f3b79
Output Blockfce6033b4edce64cbaed3f61ff5b927c
Ciphertext
42
Plaintext
beSegment #4
Input Block
030405060708090a0b0c0d0e0f3b7942
Output Blockae4e5e7ffe805f7a4395b180004f8ca8
Ciphertext
4c
Plaintexte2
Segment #5
Input Block
0405060708090a0b0c0d0e0f3b79424c
Output Blockb205eb89445b62116f1deb988a81e6dd
Ciphertext
9c
Plaintext
2eSegment #6
Input Block
05060708090a0b0c0d0e0f3b79424c9c
Output Block
4d21d456a5e239064fff4be0c0f85488
Ciphertext
0d
Plaintext
40
Segment #7
Input Block
060708090a0b0c0d0e0f3b79424c9c0d
Output Block4b2f5c3895b9efdc85ee0c5178c7fd33
Ciphertext
d4
Plaintext
9f
Segment #8
Input Block
0708090a0b0c0d0e0f3b79424c9c0dd4
Output Blocka0976d856da260a34104d1a80953db4c
Ciphertext
36
Plaintext
96
Segment #941

Input Block
Output Block
Ciphertext
Plaintext
Segment #10
Input Block
Output Block
Ciphertext
Plaintext
Segment #11
Input Block
Output Block
Ciphertext
Plaintext
Segment #12
Input Block
Output Block
Ciphertext
Plaintext
Segment #13
Input Block
Output Block
Ciphertext
Plaintext
Segment #14
Input Block
Output Block
Ciphertext
Plaintext
Segment #15
Input Block
Output Block
Ciphertext
Plaintext
Segment #16
Input Block
Output Block
Ciphertext
Plaintext
Segment #17
Input Block
Output Block
Ciphertext
Plaintext
Segment #18
Input Block
Output Block
Ciphertext
Plaintext
F.3.9
Key

08090a0b0c0d0e0f3b79424c9c0dd436
53674e5890a2c71b0f6a27a094e5808cbae9
090a0b0c0d0e0f3b79424c9c0dd436ba
f34cd32ffed495f8bc8adba194eccb7ace
3d0a0b0c0d0e0f3b79424c9c0dd436bace
e08cf2407d7ed676c9049586f1d48ba6
9e
7e
0b0c0d0e0f3b79424c9c0dd436bace9e
1f5c88a19b6ca28e99c9aeb8982a6dd8
0e
11
0c0d0e0f3b79424c9c0dd436bace9e0e
a70e63df781cf395a208bd2365c8779bd4
73
0d0e0f3b79424c9c0dd436bace9e0ed4
cbcfe8b3bcf9ac202ce18420013319ab
58
93
0e0f3b79424c9c0dd436bace9e0ed458
7d9fac6604b3c8c5b1f8c5a00956cf56
6a17
0f3b79424c9c0dd436bace9e0ed4586a
65c3fa64bf0343986825c636f4a1efd2
4f
2a3b79424c9c0dd436bace9e0ed4586a4f
9cff5e5ff4f554d56c924b9d6a6de21d
32
ae79424c9c0dd436bace9e0ed4586a4f32
946c3dc1584cc18400ecd8c6052c44b1
b9
2dCFB8-AES192.Encrypt
8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7b42

IV
Segment #1
Input Block
Output Block
Plaintext
Ciphertext
Segment #2
Input Block
Output Block
Plaintext
Ciphertext
Segment #3
Input Block
Output Block
Plaintext
Ciphertext
Segment #4
Input Block
Output Block
Plaintext
Ciphertext
Segment #5
Input Block
Output Block
Plaintext
Ciphertext
Segment #6
Input Block
Output Block
Plaintext
Ciphertext
Segment #7
Input Block
Output Block
Plaintext
Ciphertext
Segment #8
Input Block
Output Block
Plaintext
Ciphertext
Segment #9
Input Block
Output Block
Plaintext
Ciphertext
Segment #10
Input Block
Output Block
Plaintext
Ciphertext
Segment #11
Input Block
Output Block

000102030405060708090a0b0c0d0e0f
000102030405060708090a0b0c0d0e0f
a609b38df3b1133dddff2718ba09565e
6b
cd
0102030405060708090a0b0c0d0e0fcd
63c82e99e7289617c49e6851e082142ac1
a2
02030405060708090a0b0c0d0e0fcda2
ec40a5497264bfb4d6820aaae73f75af
be52
030405060708090a0b0c0d0e0fcda252
fc011a96afe968c32bae6495173a9154
e2
1e0405060708090a0b0c0d0e0fcda2521e
de019e09ac995ba46a42916ef77d8fe52ef005060708090a0b0c0d0e0fcda2521ef0
e980477efb7f896e07c4a2d527e7b537
40
a9060708090a0b0c0d0e0fcda2521ef0a9
9a9a77b11709b36e08e9321ae8b1e539
9f
05
0708090a0b0c0d0e0fcda2521ef0a905
5ca1d192a780fbca1471e10588593c7c
96ca
08090a0b0c0d0e0fcda2521ef0a905ca
addb26efd21de4d002474c7748e0bc1de9
44
090a0b0c0d0e0fcda2521ef0a905ca44
f0c410ad6512c5177a5ee40a60de01b8
3dcd
0a0b0c0d0e0fcda2521ef0a905ca44cd
7bbf71f2b4f5cf68f3c0c1b9235dbd53

43

Plaintext
Ciphertext
Segment #12
Input Block
Output Block
Plaintext
Ciphertext
Segment #13
Input Block
Output Block
Plaintext
Ciphertext
Segment #14
Input Block
Output Block
Plaintext
Ciphertext
Segment #15
Input Block
Output Block
Plaintext
Ciphertext
Segment #16
Input Block
Output Block
Plaintext
Ciphertext
Segment #17
Input Block
Output Block
Plaintext
Ciphertext
Segment #18
Input Block
Output Block
Plaintext
Ciphertext

7e05
0b0c0d0e0fcda2521ef0a905ca44cd05
6dafb26e3c63b350811394b382e14d69
117c0c0d0e0fcda2521ef0a905ca44cd057c
ccd6e25255a80e9bdbec9fbc26e5fad6
73
bf
0d0e0fcda2521ef0a905ca44cd057cbf
9e33550f6d47bda77f4f3108181ab21c
93
0d0e0fcda2521ef0a905ca44cd057cbf0d
50b3eae29a6623fbef6d726dbda675a8
17
47
0fcda2521ef0a905ca44cd057cbf0d47
8a2a57d1b9158539ef7ff42b33bf0a4a2aa0
cda2521ef0a905ca44cd057cbf0d47a0
c94e9102ac731d2f127b657d810ef5a8
ae67
a2521ef0a905ca44cd057cbf0d47a067
a765ed650568fbe386660def5f8d491d
2d8aF.3.10 CFB8-AES192.DecryptKey8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7bIV000102030405060708090a0b0c0d0e0f
Segment #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Blocka609b38df3b1133dddff2718ba09565e
Ciphertext
cd
Plaintext
6b
Segment #2
Input Block
0102030405060708090a0b0c0d0e0fcd
Output Block63c82e99e7289617c49e6851e082142a
Ciphertext
a2
Plaintext
c1
Segment #3
Input Block
02030405060708090a0b0c0d0e0fcda2

44

Output Block
Ciphertext
Plaintext
Segment #4
Input Block
Output Block
Ciphertext
Plaintext
Segment #5
Input Block
Output Block
Ciphertext
Plaintext
Segment #6
Input Block
Output Block
Ciphertext
Plaintext
Segment #7
Input Block
Output Block
Ciphertext
Plaintext
Segment #8
Input Block
Output Block
Ciphertext
Plaintext
Segment #9
Input Block
Output Block
Ciphertext
Plaintext
Segment #10
Input Block
Output Block
Ciphertext
Plaintext
Segment #11
Input Block
Output Block
Ciphertext
Plaintext
Segment #12
Input Block
Output Block
Ciphertext
Plaintext
Segment #13
Input Block
Output Block
Ciphertext
Plaintext
Segment #14

ec40a5497264bfb4d6820aaae73f75af
52
be030405060708090a0b0c0d0e0fcda252
fc011a96afe968c32bae6495173a9154
1ee2
0405060708090a0b0c0d0e0fcda2521e
de019e09ac995ba46a42916ef77d8fe5f02e05060708090a0b0c0d0e0fcda2521ef0
e980477efb7f896e07c4a2d527e7b537
a9
40
060708090a0b0c0d0e0fcda2521ef0a9
9a9a77b11709b36e08e9321ae8b1e539
05
9f
0708090a0b0c0d0e0fcda2521ef0a905
5ca1d192a780fbca1471e10588593c7cca
9608090a0b0c0d0e0fcda2521ef0a905ca
addb26efd21de4d002474c7748e0bc1d44e9
090a0b0c0d0e0fcda2521ef0a905ca44
f0c410ad6512c5177a5ee40a60de01b8
cd
3d
0a0b0c0d0e0fcda2521ef0a905ca44cd
7bbf71f2b4f5cf68f3c0c1b9235dbd53
05
7e0b0c0d0e0fcda2521ef0a905ca44cd05
6dafb26e3c63b350811394b382e14d69
7c
110c0d0e0fcda2521ef0a905ca44cd057c
ccd6e25255a80e9bdbec9fbc26e5fad6
bf
73

45

Input Block
Output Block
Ciphertext
Plaintext
Segment #15
Input Block
Output Block
Ciphertext
Plaintext
Segment #16
Input Block
Output Block
Ciphertext
Plaintext
Segment #17
Input Block
Output Block
Ciphertext
Plaintext
Segment #18
Input Block
Output Block
Ciphertext
Plaintext

0d0e0fcda2521ef0a905ca44cd057cbf
9e33550f6d47bda77f4f3108181ab21c0d
93
0e0fcda2521ef0a905ca44cd057cbf0d
50b3eae29a6623fbef6d726dbda675a8
47
170fcda2521ef0a905ca44cd057cbf0d47
8a2a57d1b9158539ef7ff42b33bf0a4aa0
2acda2521ef0a905ca44cd057cbf0d47a0
c94e9102ac731d2f127b657d810ef5a8
67aea2521ef0a905ca44cd057cbf0d47a067
a765ed650568fbe386660def5f8d491d
8a2d

F.3.11Key

CFB8-AES256.Encrypt603deb1015ca71be2b73aef0857d7781
1f352c073b6108d72d9810a30914dff4IV000102030405060708090a0b0c0d0e0f
Segment #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Blockb7bf3a5df43989dd97f0fa97ebce2f4a
Plaintext
6b
Ciphertext
dc
Segment #2
Input Block
0102030405060708090a0b0c0d0e0fdc
Output Block
ded5faadb1068af80e774684b9f84870
Plaintext
c1
Ciphertext
1f
Segment #3
Input Block
02030405060708090a0b0c0d0e0fdc1f
Output Blocka41e327e5273366ce9403cdbdb92c1cc
Plaintext
beCiphertext
1a
Segment #4
Input Block
030405060708090a0b0c0d0e0fdc1f1a
Output Block67938ae7d34df4ec2c0aec33eb98318f
Plaintext
e2
Ciphertext
85
Segment #5
Input Block
0405060708090a0b0c0d0e0fdc1f1a85
Output Block0e8f2e31efff615d3c93946609808c37
Plaintext2e46

Ciphertext
Segment #6
Input Block
Output Block
Plaintext
Ciphertext
Segment #7
Input Block
Output Block
Plaintext
Ciphertext
Segment #8
Input Block
Output Block
Plaintext
Ciphertext
Segment #9
Input Block
Output Block
Plaintext
Ciphertext
Segment #10
Input Block
Output Block
Plaintext
Ciphertext
Segment #11
Input Block
Output Block
Plaintext
Ciphertext
Segment #12
Input Block
Output Block
Plaintext
Ciphertext
Segment #13
Input Block
Output Block
Plaintext
Ciphertext
Segment #14
Input Block
Output Block
Plaintext
Ciphertext
Segment #15
Input Block
Output Block
Plaintext
Ciphertext
Segment #16
Input Block
Output Block2005060708090a0b0c0d0e0fdc1f1a8520
e648bb37a95c94c72784162a79dfe30640
a6060708090a0b0c0d0e0fdc1f1a8520a6
d278f3147290fc5dd0b7d2e82764a1fd
9f
4d
0708090a0b0c0d0e0fdc1f1a8520a64d
2388d255a3e8a8059675e3a7de19dceb
96b508090a0b0c0d0e0fdc1f1a8520a64db5
b6b8008f6c6dc2d6144641ed2023f0f5
e9
5f
090a0b0c0d0e0fdc1f1a8520a64db55f
f18f88a7aa3e3a6167dd93fb1137713a3d
cc
0a0b0c0d0e0fdc1f1a8520a64db55fcc
f46c5e67bff7c070b26c0318c52d0ccd
7e
8a
0b0c0d0e0fdc1f1a8520a64db55fcc8a
d4dceae622f8f21d27375d8c2c5f9fba
11
c5
0c0d0e0fdc1f1a8520a64db55fcc8ac5
27e9e0d0a016709cd3ae0b5a9a242e3173
540d0e0fdc1f1a8520a64db55fcc8ac554
17f69d50ce64ba0d085de70b9030bbb2
93
84
0e0fdc1f1a8520a64db55fcc8ac55484
59106ee400d18e104337669628c33cdd
17
4e
0fdc1f1a8520a64db55fcc8ac554844e
a29c6ac87e2245ec0796772c1f5312a8

47

Plaintext
Ciphertext
Segment #17
Input Block
Output Block
Plaintext
Ciphertext
Segment #18
Input Block
Output Block
Plaintext
Ciphertext

2a88
dc1f1a8520a64db55fcc8ac554844e88
397b98fa2ec0ff8cc0cd821909551c9e
ae
97
1f1a8520a64db55fcc8ac554844e8897
2d2d6fe9aef72f7b914b623a9c7abd54
2d00

F.3.12Key

CFB8-AES256.Decrypt603deb1015ca71be2b73aef0857d7781
1f352c073b6108d72d9810a30914dff4IV000102030405060708090a0b0c0d0e0f
Segment #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Blockb7bf3a5df43989dd97f0fa97ebce2f4a
Ciphertext
dc
Plaintext
6b
Segment #2
Input Block
0102030405060708090a0b0c0d0e0fdc
Output Block
ded5faadb1068af80e774684b9f84870
Ciphertext
1f
Plaintext
c1
Segment #3
Input Block
02030405060708090a0b0c0d0e0fdc1f
Output Blocka41e327e5273366ce9403cdbdb92c1cc
Ciphertext
1a
Plaintext
beSegment #4
Input Block
030405060708090a0b0c0d0e0fdc1f1a
Output Block67938ae7d34df4ec2c0aec33eb98318f
Ciphertext
85
Plaintexte2
Segment #5
Input Block
0405060708090a0b0c0d0e0fdc1f1a85
Output Block0e8f2e31efff615d3c93946609808c37
Ciphertext
20
Plaintext
2eSegment #6
Input Block
05060708090a0b0c0d0e0fdc1f1a8520
Output Blocke648bb37a95c94c72784162a79dfe306
Ciphertext
a6
Plaintext
40
Segment #7
Input Block
060708090a0b0c0d0e0fdc1f1a8520a6
Output Blockd278f3147290fc5dd0b7d2e82764a1fd
Ciphertext
4d
Plaintext
9f
Segment #8

48

Input Block
Output Block
Ciphertext
Plaintext
Segment #9
Input Block
Output Block
Ciphertext
Plaintext
Segment #10
Input Block
Output Block
Ciphertext
Plaintext
Segment #11
Input Block
Output Block
Ciphertext
Plaintext
Segment #12
Input Block
Output Block
Ciphertext
Plaintext
Segment #13
Input Block
Output Block
Ciphertext
Plaintext
Segment #14
Input Block
Output Block
Ciphertext
Plaintext
Segment #15
Input Block
Output Block
Ciphertext
Plaintext
Segment #16
Input Block
Output Block
Ciphertext
Plaintext
Segment #17
Input Block
Output Block
Ciphertext
Plaintext
Segment #18
Input Block
Output Block
Ciphertext
Plaintext

0708090a0b0c0d0e0fdc1f1a8520a64d
2388d255a3e8a8059675e3a7de19dceb
b5
9608090a0b0c0d0e0fdc1f1a8520a64db5
b6b8008f6c6dc2d6144641ed2023f0f5
5f
e9
090a0b0c0d0e0fdc1f1a8520a64db55f
f18f88a7aa3e3a6167dd93fb1137713acc
3d
0a0b0c0d0e0fdc1f1a8520a64db55fcc
f46c5e67bff7c070b26c0318c52d0ccd
8a7e
0b0c0d0e0fdc1f1a8520a64db55fcc8a
d4dceae622f8f21d27375d8c2c5f9fba
c5
11
0c0d0e0fdc1f1a8520a64db55fcc8ac5
27e9e0d0a016709cd3ae0b5a9a242e31
5473
0d0e0fdc1f1a8520a64db55fcc8ac554
17f69d50ce64ba0d085de70b9030bbb2
84
93
0e0fdc1f1a8520a64db55fcc8ac55484
59106ee400d18e104337669628c33cdd
4e
17
0fdc1f1a8520a64db55fcc8ac554844e
a29c6ac87e2245ec0796772c1f5312a8
88
2adc1f1a8520a64db55fcc8ac554844e88
397b98fa2ec0ff8cc0cd821909551c9e
97ae
1f1a8520a64db55fcc8ac554844e8897
2d2d6fe9aef72f7b914b623a9c7abd54
00
2d

49

F.3.13 CFB128-AES128.EncryptKey2b7e151628aed2a6abf7158809cf4f3c
IV000102030405060708090a0b0c0d0e0f
Segment #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Block
50fe67cc996d32b6da0937e99bafec60
Plaintext
6bc1bee22e409f96e93d7e117393172a
Ciphertext
3b3fd92eb72dad20333449f8e83cfb4a
Segment #2
Input Block3b3fd92eb72dad20333449f8e83cfb4a
Output Block668bcf60beb005a35354a201dab36bda
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Ciphertext
c8a64537a0b3a93fcde3cdad9f1ce58b
Segment #3
Input Blockc8a64537a0b3a93fcde3cdad9f1ce58b
Output Block16bd032100975551547b4de89daea630
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Ciphertext
26751f67a3cbb140b1808cf187a4f4df
Segment #4
Input Block26751f67a3cbb140b1808cf187a4f4df
Output Block36d42170a312871947ef8714799bc5f6
Plaintext
f69f2445df4f9b17ad2b417be66c3710
Ciphertext
c04b05357c5d1c0eeac4c66f9ff7f2e6
F.3.14 CFB128-AES128.DecryptKey2b7e151628aed2a6abf7158809cf4f3c
IV000102030405060708090a0b0c0d0e0f
Segment #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Block
50fe67cc996d32b6da0937e99bafec60
Ciphertext
3b3fd92eb72dad20333449f8e83cfb4a
Plaintext
6bc1bee22e409f96e93d7e117393172a
Segment #2
Input Block3b3fd92eb72dad20333449f8e83cfb4a
Output Block668bcf60beb005a35354a201dab36bda
Ciphertext
c8a64537a0b3a93fcde3cdad9f1ce58b
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Segment #3
Input Blockc8a64537a0b3a93fcde3cdad9f1ce58b
Output Block16bd032100975551547b4de89daea630
Ciphertext
26751f67a3cbb140b1808cf187a4f4df
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Segment #4
Input Block26751f67a3cbb140b1808cf187a4f4df
Output Block36d42170a312871947ef8714799bc5f6
Ciphertext
c04b05357c5d1c0eeac4c66f9ff7f2e6
Plaintext
f69f2445df4f9b17ad2b417be66c3710
F.3.15 CFB128-AES192.EncryptKey8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7bIV000102030405060708090a0b0c0d0e0f
Segment #1

50

Input Block
Output Block
Plaintext
Ciphertext
Segment #2
Input Block
Output Block
Plaintext
Ciphertext
Segment #3
Input Block
Output Block
Plaintext
Ciphertext
Segment #4
Input Block
Output Block
Plaintext
Ciphertext

000102030405060708090a0b0c0d0e0f
a609b38df3b1133dddff2718ba09565e
6bc1bee22e409f96e93d7e117393172a
cdc80d6fddf18cab34c25909c99a4174
cdc80d6fddf18cab34c25909c99a4174
c9e3f5289f149abd08ad44dc52b2b32b
ae2d8a571e03ac9c9eb76fac45af8e51
67ce7f7f81173621961a2b70171d3d7a67ce7f7f81173621961a2b70171d3d7a
1ed6965b76c76ca02d1dcef404f09626
30c81c46a35ce411e5fbc1191a0a52ef
2e1e8a1dd59b88b1c8e60fed1efac4c9
2e1e8a1dd59b88b1c8e60fed1efac4c9
36c0bbd976ccd4b7ef85cec1be273eef
f69f2445df4f9b17ad2b417be66c3710
c05f9f9ca9834fa042ae8fba584b09ff

F.3.16 CFB128-AES192.DecryptKey8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7bIV000102030405060708090a0b0c0d0e0f
Segment #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Blocka609b38df3b1133dddff2718ba09565e
Ciphertext
cdc80d6fddf18cab34c25909c99a4174
Plaintext
6bc1bee22e409f96e93d7e117393172a
Segment #2
Input Block
cdc80d6fddf18cab34c25909c99a4174
Output Blockc9e3f5289f149abd08ad44dc52b2b32b
Ciphertext
67ce7f7f81173621961a2b70171d3d7a
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Segment #3
Input Block67ce7f7f81173621961a2b70171d3d7a
Output Block
1ed6965b76c76ca02d1dcef404f09626
Ciphertext
2e1e8a1dd59b88b1c8e60fed1efac4c9
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Segment #4
Input Block2e1e8a1dd59b88b1c8e60fed1efac4c9
Output Block36c0bbd976ccd4b7ef85cec1be273eef
Ciphertext
c05f9f9ca9834fa042ae8fba584b09ff
Plaintext
f69f2445df4f9b17ad2b417be66c3710
F.3.17Key

CFB128-AES256.Encrypt603deb1015ca71be2b73aef0857d7781
1f352c073b6108d72d9810a30914dff4IV000102030405060708090a0b0c0d0e0f
Segment #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Blockb7bf3a5df43989dd97f0fa97ebce2f4a
Plaintext
6bc1bee22e409f96e93d7e117393172a
Ciphertext
dc7e84bfda79164b7ecd8486985d3860

51Segment #2
Input Block
Output Block
Plaintext
Ciphertext
Segment #3
Input Block
Output Block
Plaintext
Ciphertext
Segment #4
Input Block
Output Block
Plaintext
Ciphertext

dc7e84bfda79164b7ecd8486985d3860
97d26743252b1d54aca653cf744ace2aae2d8a571e03ac9c9eb76fac45af8e51
39ffed143b28b1c832113c6331e5407b
39ffed143b28b1c832113c6331e5407b
efd80f62b6b9af8344c511b13c70b016
30c81c46a35ce411e5fbc1191a0a52ef
df10132415e54b92a13ed0a8267ae2f9
df10132415e54b92a13ed0a8267ae2f9833ca131c5f655ef8d1a2346b3ddd361
f69f2445df4f9b17ad2b417be66c3710
75a385741ab9cef82031623d55b1e471

F.3.18Key

CFB128-AES256.Decrypt603deb1015ca71be2b73aef0857d7781
1f352c073b6108d72d9810a30914dff4IV000102030405060708090a0b0c0d0e0f
Segment #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Blockb7bf3a5df43989dd97f0fa97ebce2f4a
Ciphertext
dc7e84bfda79164b7ecd8486985d3860
Plaintext
6bc1bee22e409f96e93d7e117393172a
Segment #2
Input Blockdc7e84bfda79164b7ecd8486985d3860
Output Block
97d26743252b1d54aca653cf744ace2a
Ciphertext
39ffed143b28b1c832113c6331e5407b
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Segment #3
Input Block39ffed143b28b1c832113c6331e5407b
Output Blockefd80f62b6b9af8344c511b13c70b016
Ciphertext
df10132415e54b92a13ed0a8267ae2f9
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Segment #4
Input Blockdf10132415e54b92a13ed0a8267ae2f9
Output Block833ca131c5f655ef8d1a2346b3ddd361
Ciphertext
75a385741ab9cef82031623d55b1e471
Plaintext
f69f2445df4f9b17ad2b417be66c3710
F.4

OFB Example Vectors

F.4.1
OFB-AES128.EncryptKey2b7e151628aed2a6abf7158809cf4f3c
IV000102030405060708090a0b0c0d0e0f
Block #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Block
50fe67cc996d32b6da0937e99bafec60
Plaintext
6bc1bee22e409f96e93d7e117393172a
Ciphertext
3b3fd92eb72dad20333449f8e83cfb4a
Block #2
Input Block
50fe67cc996d32b6da0937e99bafec60

52

Output Block
Plaintext
Ciphertext
Block #3
Input Block
Output Block
Plaintext
Ciphertext
Block #4
Input Block
Output Block
Plaintext
Ciphertext

d9a4dada0892239f6b8b3d7680e15674
ae2d8a571e03ac9c9eb76fac45af8e51
7789508d16918f03f53c52dac54ed825
d9a4dada0892239f6b8b3d7680e15674
a78819583f0308e7a6bf36b1386abf23
30c81c46a35ce411e5fbc1191a0a52ef
9740051e9c5fecf64344f7a82260edcc
a78819583f0308e7a6bf36b1386abf23
c6d3416d29165c6fcb8e51a227ba994e
f69f2445df4f9b17ad2b417be66c3710
304c6528f659c77866a510d9c1d6ae5e

F.4.2
OFB-AES128.DecryptKey2b7e151628aed2a6abf7158809cf4f3c
IV000102030405060708090a0b0c0d0e0f
Block #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Block
50fe67cc996d32b6da0937e99bafec60
Ciphertext
3b3fd92eb72dad20333449f8e83cfb4a
Plaintext
6bc1bee22e409f96e93d7e117393172a
Block #2
Input Block
50fe67cc996d32b6da0937e99bafec60
Output Block
d9a4dada0892239f6b8b3d7680e15674
Ciphertext
7789508d16918f03f53c52dac54ed825
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Block #3
Input Block
d9a4dada0892239f6b8b3d7680e15674
Output Blocka78819583f0308e7a6bf36b1386abf23
Ciphertext
9740051e9c5fecf64344f7a82260edcc
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Block #4
Input Blocka78819583f0308e7a6bf36b1386abf23
Output Blockc6d3416d29165c6fcb8e51a227ba994e
Ciphertext
304c6528f659c77866a510d9c1d6ae5e
Plaintext
f69f2445df4f9b17ad2b417be66c3710
F.4.3
OFB-AES192.EncryptKey8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7bIV000102030405060708090a0b0c0d0e0f
Block #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Blocka609b38df3b1133dddff2718ba09565e
Plaintext
6bc1bee22e409f96e93d7e117393172a
Ciphertext
cdc80d6fddf18cab34c25909c99a4174
Block #2
Input Blocka609b38df3b1133dddff2718ba09565e
Output Block52ef01da52602fe0975f78ac84bf8a50
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Ciphertext
fcc28b8d4c63837c09e81700c1100401
Block #3
Input Block52ef01da52602fe0975f78ac84bf8a50

53

Output Block
Plaintext
Ciphertext
Block #4
Input Block
Output Block
Plaintext
Ciphertext

bd5286ac63aabd7eb067ac54b553f71d
30c81c46a35ce411e5fbc1191a0a52ef
8d9a9aeac0f6596f559c6d4daf59a5f2
bd5286ac63aabd7eb067ac54b553f71d
9b00044d8885f729318713303fc0fe3a
f69f2445df4f9b17ad2b417be66c3710
6d9f200857ca6c3e9cac524bd9acc92a

F.4.4
OFB-AES192.DecryptKey8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7bIV000102030405060708090a0b0c0d0e0f
Block #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Blocka609b38df3b1133dddff2718ba09565e
Ciphertext
cdc80d6fddf18cab34c25909c99a4174
Plaintext
6bc1bee22e409f96e93d7e117393172a
Block #2
Input Blocka609b38df3b1133dddff2718ba09565e
Output Block52ef01da52602fe0975f78ac84bf8a50
Ciphertext
fcc28b8d4c63837c09e81700c1100401
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Block #3
Input Block52ef01da52602fe0975f78ac84bf8a50
Output Blockbd5286ac63aabd7eb067ac54b553f71d
Ciphertext
8d9a9aeac0f6596f559c6d4daf59a5f2
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Block #4
Input Blockbd5286ac63aabd7eb067ac54b553f71d
Output Block
9b00044d8885f729318713303fc0fe3a
Ciphertext
6d9f200857ca6c3e9cac524bd9acc92a
Plaintext
f69f2445df4f9b17ad2b417be66c3710
F.4.5
Key

OFB-AES256.Encrypt603deb1015ca71be2b73aef0857d7781
1f352c073b6108d72d9810a30914dff4IV000102030405060708090a0b0c0d0e0f
Block #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Blockb7bf3a5df43989dd97f0fa97ebce2f4a
Plaintext
6bc1bee22e409f96e93d7e117393172a
Ciphertext
dc7e84bfda79164b7ecd8486985d3860
Block #2
Input Blockb7bf3a5df43989dd97f0fa97ebce2f4a
Output Blocke1c656305ed1a7a6563805746fe03edc
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Ciphertext
4febdc6740d20b3ac88f6ad82a4fb08d
Block #3
Input Blocke1c656305ed1a7a6563805746fe03edc
Output Block41635be625b48afc1666dd42a09d96e7
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Ciphertext
71ab47a086e86eedf39d1c5bba97c408
Block #4

54

Input Block
Output Block
Plaintext
Ciphertext

41635be625b48afc1666dd42a09d96e7
f7b93058b8bce0fffea41bf0012cd394
f69f2445df4f9b17ad2b417be66c3710
0126141d67f37be8538f5a8be740e484

F.4.6
Key

OFB-AES256.Decrypt603deb1015ca71be2b73aef0857d7781
1f352c073b6108d72d9810a30914dff4IV000102030405060708090a0b0c0d0e0f
Block #1
Input Block
000102030405060708090a0b0c0d0e0f
Output Blockb7bf3a5df43989dd97f0fa97ebce2f4a
Ciphertext
dc7e84bfda79164b7ecd8486985d3860
Plaintext
6bc1bee22e409f96e93d7e117393172a
Block #2
Input Blockb7bf3a5df43989dd97f0fa97ebce2f4a
Output Blocke1c656305ed1a7a6563805746fe03edc
Ciphertext
4febdc6740d20b3ac88f6ad82a4fb08d
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Block #3
Input Blocke1c656305ed1a7a6563805746fe03edc
Output Block41635be625b48afc1666dd42a09d96e7
Ciphertext
71ab47a086e86eedf39d1c5bba97c408
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Block #4
Input Block41635be625b48afc1666dd42a09d96e7
Output Blockf7b93058b8bce0fffea41bf0012cd394
Ciphertext
0126141d67f37be8538f5a8be740e484
Plaintext
f69f2445df4f9b17ad2b417be66c3710
F.5

CTR Example Vectors

F.5.1
CTR-AES128.EncryptKey2b7e151628aed2a6abf7158809cf4f3c
Init. Counter f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff
Block #1
Input Blockf0f1f2f3f4f5f6f7f8f9fafbfcfdfeff
Output Blockec8cdf7398607cb0f2d21675ea9ea1e4
Plaintext
6bc1bee22e409f96e93d7e117393172a
Ciphertext
874d6191b620e3261bef6864990db6ce
Block #2
Input Blockf0f1f2f3f4f5f6f7f8f9fafbfcfdff00
Output Block362b7c3c6773516318a077d7fc5073ae
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Ciphertext
9806f66b7970fdff8617187bb9fffdff
Block #3
Input Blockf0f1f2f3f4f5f6f7f8f9fafbfcfdff01
Output Block
6a2cc3787889374fbeb4c81b17ba6c44
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Ciphertext
5ae4df3edbd5d35e5b4f09020db03eab
Block #4
Input Blockf0f1f2f3f4f5f6f7f8f9fafbfcfdff02
Output Blocke89c399ff0f198c6d40a31db156cabfe

55

Plaintext
Ciphertext

f69f2445df4f9b17ad2b417be66c3710
1e031dda2fbe03d1792170a0f3009cee

F.5.2
CTR-AES128.DecryptKey2b7e151628aed2a6abf7158809cf4f3c
Init. Counter f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff
Block #1
Input Blockf0f1f2f3f4f5f6f7f8f9fafbfcfdfeff
Output Blockec8cdf7398607cb0f2d21675ea9ea1e4
Ciphertext
874d6191b620e3261bef6864990db6ce
Plaintext
6bc1bee22e409f96e93d7e117393172a
Block #2
Input Blockf0f1f2f3f4f5f6f7f8f9fafbfcfdff00
Output Block362b7c3c6773516318a077d7fc5073ae
Ciphertext
9806f66b7970fdff8617187bb9fffdff
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Block #3
Input Blockf0f1f2f3f4f5f6f7f8f9fafbfcfdff01
Output Block
6a2cc3787889374fbeb4c81b17ba6c44
Ciphertext
5ae4df3edbd5d35e5b4f09020db03eab
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Block #4
Input Blockf0f1f2f3f4f5f6f7f8f9fafbfcfdff02
Output Blocke89c399ff0f198c6d40a31db156cabfe
Ciphertext
1e031dda2fbe03d1792170a0f3009cee
Plaintext
f69f2445df4f9b17ad2b417be66c3710
F.5.3
CTR-AES192.EncryptKey8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7bInit. Counter f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff
Block #1
Input Blockf0f1f2f3f4f5f6f7f8f9fafbfcfdfeff
Output Block717d2dc639128334a6167a488ded7921
Plaintext
6bc1bee22e409f96e93d7e117393172a
Ciphertext
1abc932417521ca24f2b0459fe7e6e0b
Block #2
Input Blockf0f1f2f3f4f5f6f7f8f9fafbfcfdff00
Output Blocka72eb3bb14a556734b7bad6ab16100c5
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Ciphertext
090339ec0aa6faefd5ccc2c6f4ce8e94
Block #3
Input Blockf0f1f2f3f4f5f6f7f8f9fafbfcfdff01
Output Block2efeae2d72b722613446dc7f4c2af918
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Ciphertext
1e36b26bd1ebc670d1bd1d665620abf7
Block #4
Input Blockf0f1f2f3f4f5f6f7f8f9fafbfcfdff02
Output Blockb9e783b30dd7924ff7bc9b97beaa8740
Plaintext
f69f2445df4f9b17ad2b417be66c3710
Ciphertext
4f78a7f6d29809585a97daec58c6b050

56

F.5.4CTR-AES192.DecryptKey8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7bInit. Counter f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff
Block #1
Input Blockf0f1f2f3f4f5f6f7f8f9fafbfcfdfeff
Output Block717d2dc639128334a6167a488ded7921
Ciphertext
1abc932417521ca24f2b0459fe7e6e0b
Plaintext
6bc1bee22e409f96e93d7e117393172a
Block #2
Input Blockf0f1f2f3f4f5f6f7f8f9fafbfcfdff00
Output Blocka72eb3bb14a556734b7bad6ab16100c5
Ciphertext
090339ec0aa6faefd5ccc2c6f4ce8e94
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Block #3
Input Blockf0f1f2f3f4f5f6f7f8f9fafbfcfdff01
Output Block2efeae2d72b722613446dc7f4c2af918
Ciphertext
1e36b26bd1ebc670d1bd1d665620abf7
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Block #4
Input Blockf0f1f2f3f4f5f6f7f8f9fafbfcfdff02
Output Blockb9e783b30dd7924ff7bc9b97beaa8740
Ciphertext
4f78a7f6d29809585a97daec58c6b050
Plaintext
f69f2445df4f9b17ad2b417be66c3710
F.5.5
Key

CTR-AES256.Encrypt603deb1015ca71be2b73aef0857d7781
1f352c073b6108d72d9810a30914dff4
Init. Counter f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff
Block #1
Input Blockf0f1f2f3f4f5f6f7f8f9fafbfcfdfeff
Output Block0bdf7df1591716335e9a8b15c860c502
Plaintext
6bc1bee22e409f96e93d7e117393172a
Ciphertext
601ec313775789a5b7a7f504bbf3d228
Block #2
Input Blockf0f1f2f3f4f5f6f7f8f9fafbfcfdff00
Output Block5a6e699d536119065433863c8f657b94
Plaintext
ae2d8a571e03ac9c9eb76fac45af8e51
Ciphertext
f443e3ca4d62b59aca84e990cacaf5c5
Block #3
Input Blockf0f1f2f3f4f5f6f7f8f9fafbfcfdff01
Output Block1bc12c9c01610d5d0d8bd6a3378eca62
Plaintext
30c81c46a35ce411e5fbc1191a0a52ef
Ciphertext
2b0930daa23de94ce87017ba2d84988d
Block #4
Input Blockf0f1f2f3f4f5f6f7f8f9fafbfcfdff02
Output Block2956e1c8693536b1bee99c73a31576b6
Plaintext
f69f2445df4f9b17ad2b417be66c3710
Ciphertext
dfc9c58db67aada613c2dd08457941a6
F.5.6
Key

CTR-AES256.Decrypt603deb1015ca71be2b73aef0857d7781
1f352c073b6108d72d9810a30914dff4
Init. Counter f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff

57

Block #1
Input Block
Output Block
Ciphertext
Plaintext
Block #2
Input Block
Output Block
Ciphertext
Plaintext
Block #3
Input Block
Output Block
Ciphertext
Plaintext
Block #4
Input Block
Output Block
Ciphertext
Plaintext

f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff
0bdf7df1591716335e9a8b15c860c502
601ec313775789a5b7a7f504bbf3d228
6bc1bee22e409f96e93d7e117393172a
f0f1f2f3f4f5f6f7f8f9fafbfcfdff00
5a6e699d536119065433863c8f657b94
f443e3ca4d62b59aca84e990cacaf5c5
ae2d8a571e03ac9c9eb76fac45af8e51
f0f1f2f3f4f5f6f7f8f9fafbfcfdff01
1bc12c9c01610d5d0d8bd6a3378eca62
2b0930daa23de94ce87017ba2d84988d
30c81c46a35ce411e5fbc1191a0a52ef
f0f1f2f3f4f5f6f7f8f9fafbfcfdff02
2956e1c8693536b1bee99c73a31576b6
dfc9c58db67aada613c2dd08457941a6
f69f2445df4f9b17ad2b417be66c3710

58Appendix G: References[1]

American National Standard for Financial Services X9.52-1998, “Triple Data Encryption
Algorithm Modes of Operation.” American Bankers Association, Washington, D.C., July29, 1998.

[2]

FIPS Publication 197, “Advanced Encryption Standard (AES).” U.S. DoC/NIST,
November 26, 2001.

[3]

FIPS Publication 46-3, “Data Encryption Standard (DES).” U.S. DoC/NIST, October 25,
1999.

[4]

FIPS Publication 81, “DES Modes of Operation.” U.S. DoC/NIST, December 1980.

[5]

A. Menezes, P. van Oorschot, and S. Vanstone, “Handbook of Applied Cryptography.”
CRC Press, New York, 1997.

59